CVE-2026-129454

The Zr.Admin.NET project (commits 85cff6a through eb9228a) contains an Insecure Direct Object Reference (IDOR) vulnerability in the GET /workflow/instance/{instanceId} endpoint. This flaw allows authenticated low-privilege attackers to bypass authorization by enumerating sequential instance IDs. ...