Threats tagged 'ghsa-rhw4-mxv2-6w6q'

An insecure direct object reference (IDOR) vulnerability exists in Zr.Admin.NET between commits e6ceaf4 and eb9228a in the FrontArticleController. Authenticated users can exploit this flaw to change the visibility and pin state of other users' articles by sending a crafted PUT request with their own UserId. This allows private articles to be made public and then accessed anonymously via a GET request.