Technical impact
Zr.Admin.NET contains an insecure direct object reference flaw in the FrontArticleController that lets an authenticated user send a PUT request to /front/article/changePublic with their own UserId. The request changes other users’ article visibility and pin state, allowing private articles to be made public and subsequently read through a public GET endpoint. The weakness is a classic IDOR (CWE‑639) that bypasses ownership checks and exposes content that was intended to remain private.
Affected Systems
The vulnerable code exists in Zr.Admin.NET between the commits e6ceaf4 and eb9228a of the izhaorui Zr.Admin.NET repository. No specific release number is mentioned, so all releases that include code from these commit ranges are impacted.
Risk and Exploitability
The CVSS score of 5.3 indicates medium severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, implying no widespread exploitation yet. Exploitation requires authenticated access, and it is inferred that attackers need to obtain valid user credentials—through phishing, credential reuse, insider activity, or other means—to issue the malicious request. If such credentials are compromised, an attacker can covertly change others’ articles to public and read them anonymously, compromising confidentiality. The risk is moderate and should be mitigated promptly.
