Threats tagged 'ghsa-h8cq-rcm7-x963'

Zr.Admin.NET versions between commits 85cff6a and eb9228a contain an insecure direct object reference (IDOR) vulnerability in the GET /workflow/instance/{instanceId} endpoint. This flaw allows authenticated low-privilege users to enumerate sequential instance IDs and access workflow instances belonging to other users, exposing sensitive data such as approval requests, form contents, applicant details, and approval records.