Read the docs
TI-2026-83119 Aliases CVE-2026-119645GHSA-j826-m6j5-hvhv

Missing authorization in ZenTao PMS lets users read private documents

Priority LOW 31CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

ZenTao PMS through 22.6 contains a missing authorization flaw in doc::ajaxGetDoc() that is classified as CWE-639 (Authorization Bypass Through User-Controlled Key). An authenticated user with low privileges can enumerate sequential document ids to read the body and draft content of private documents and restricted library, product, project, or team documents. The CVSS 4.0 base score is 7.1 (HIGH).

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated users to read documents without checkPrivDoc() access checks. Low-privilege attackers can enumerate sequential document ids to retrieve body and draft content of private documents and restricted library, product, project, or team documents.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00388 33rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
easysoftzentaopmsup to 22.6—No fix listedCNA
  • zentaopms Vendoreasysoft Affected up to 22.6 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for ZenTao PMS.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-119645
  2. 2026-10-30 CISA SSVC decision points changed
  3. 2026-10-30 Priority changed: MEDIUM → LOW
  4. 2026-10-30 Alias added: GHSA-j826-m6j5-hvhv

References

Advisory 1

Other 3

  • TI-2026-75080 ZenTao PMS Authorization Bypass via action::editComment CVSS 4.0MEDIUM 5.3
  • TI-2026-78772 ZenTao PMS Authorization Bypass via Ajax Controller Methods CVSS 4.0HIGH 7.1
  • TI-2026-84800 Improper privilege management in EasySoft ZenTao PMS User module CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences