ZenSite EMS / ZenGrid — zensite-manager Security Patch v1.1.0

Release Information

Field	Value
Version	v1.1.0
Release Date	2026-07-06
Release Type	Security Patch
Urgency	Critical — immediate deployment recommended
Component	zensite-manager

Summary

This release remediates four security findings identified through an authorised external penetration test and internal security review. The fixes close a cross-tenant data exposure, a stored cross-site scripting (XSS) issue, an authorization gap around privileged scripting, and an open-redirect risk in the apex domain redirect.

Deployment is recommended for all affected deployments.

Security Fixes

Finding	Severity	Summary
C1 — Cross-tenant data exposure	Critical	Tenant selection could be influenced, allowing one tenant's users to read another tenant's data.
C2 — Stored XSS in map marker labels	Critical	A stored value rendered in the dashboard map could execute script in a viewer's session.
C3 — Privileged scripting authorization gap	Critical	JavaScript and Groovy rulesets could be configured without the required super-user privilege.
H1 — Apex redirect open redirect	High	The apex domain redirect could send users to an attacker-chosen host.

Affected Components

Component	Notes
zensite-manager — Summary / Load modules	C1 fix applied
zensite-manager — Dashboard map widget	C2 fix applied
zensite-manager — Ruleset configuration	C3 fix applied
zensite-manager — Edge / apex redirect	H1 fix applied

Other ZenSite stack components are not changed in this release.

Update Instructions

SaaS platform (orb.met3r.com): the update is applied automatically. No customer action is required.

Self-hosted deployments: pull the updated container image and redeploy. The H1 fix affects the edge proxy configuration and should be verified on a staging deployment that runs the proxy before rolling out to production.

Support

• Security issues: report@met3r.com
• General support: contact your METER account representative