Technical impact
Zr.Admin.NET suffers a missing authorization flaw in the Get method of its TasksController, allowing any logged‑in user who does not possess the monitor:job permission to retrieve details about scheduled tasks. The exposed information includes job parameters, API URLs, cron expressions, and stored SQL statements. This unauthorized read is a classic example of CWE‑862: Missing Authorization.
Affected Systems
All installations of Zr.Admin.NET that include the code between commits 1845017 and eb9228a are vulnerable. The defect resides in the ZR.Admin.WebApi/Controllers/System/TasksController.cs file and affects the /system/Tasks/get endpoint. No specific major version is listed, but the vulnerability exists in the codebase up to the mentioned commits.
Risk and Exploitability
The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, implying limited known exploitation activity. The vulnerability is not listed in the CISA KEV catalog. An attacker must be a logged‑in user; no external access or elevated privileges are required. Exploitation requires only HTTP requests to the vulnerable endpoint, or to the unprotected /monitor/jobLog/list endpoint to obtain job IDs, after which the attacker can call /system/Tasks/get to read job details. The impact is confidential data exposure with potential downstream risks if stored SQL or API URLs are compromised.
