CVE-2026-129455

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-129455
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-129455.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-129455
Published
2026-11-15T01:49:37Z
Modified
2026-11-15T10:45:21Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Zr.Admin.NET commit e6ceaf4 through eb9228a IDOR via front/article API
Details

Zr.Admin.NET commit e6ceaf4 through commit eb9228a contains an insecure direct object reference vulnerability in FrontArticleController that allows authenticated users to change other users' article visibility and pin state. Attackers can send PUT /front/article/changePublic with their own UserId in the body to make private articles public, then read them anonymously via GET /front/article/{id}.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/129xxx/CVE-2026-129455.json"
}
References

Affected packages

Git / github.com/izhaorui/Zr.Admin.NET

Affected ranges

Type
GIT
Repo
https://github.com/izhaorui/Zr.Admin.NET
Events
Introduced
e6ceaf47548f1a485f3ba3f4c139905e90fee0a2
Last Affected
eb9228a23014f6000c06cab2f10ae0d44ecbbd3a
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "e6ceaf47548f1a485f3ba3f4c139905e90fee0a2"
                },
                {
                    "last_affected": "eb9228a23014f6000c06cab2f10ae0d44ecbbd3a"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-129455.json"