Technical impact
Zr.Admin.NET contains an insecure direct object reference that allows authenticated users with low privileges to access the details of other users' workflow instances. The vulnerability manifests on the GET /workflow/instance/{instanceId} endpoint, enabling the enumeration of sequential instance identifiers and retrieval of approval requests, submitted form data, applicant details, and approval records. This flaw exposes confidential business information.
Affected Systems
The affected product is Zr.Admin.NET from vendor izhaorui. Any deployment incorporating code from commit 85cff6a up to and including commit eb9228a is susceptible. Versions built from the Zr.Admin.NET source code that contain these commits remain at risk until an updated build excluding the vulnerable code is deployed.
Risk and Exploitability
The CVSS score of 7.1 classifies the flaw as a high severity vulnerability, and the lack of a current EPSS score indicates that exploitation likelihood cannot be precisely quantified. Because the attack requires only a logged-in user with normal access rights and no privilege escalation, the attack surface remains broad within any organization utilizing the application. The vulnerability is not listed in CISA's KEV catalog, suggesting it is not a widely known or actively exploited vulnerability at this time. Nonetheless, the combination of an IDOR and the ability to enumerate sensitive information warrants careful attention.
