Live › vulnerability › CVE-2026-119645
ZenTao PMS through 22.6 skips its document permission check in doc::ajaxGetDoc(), so any logged-in user can read documents they should not see. An attacker can enumerate sequential document ids to pull body and draft text from private and restricted library, product, project, or team documents.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 15:31 UTC. All times on this page are UTC.
Self-hosted ZenTao PMS up to and including 22.6 with more than one user. Any logged-in account, including a low-privilege one, can read the body and drafts of private or team-restricted documents by guessing sequential document ids. Single-user instances, or ones where every user may see every document, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| zentaopms | vendor | <= 22.6 | – |
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated users to read documents without checkPrivDoc() access checks. Low-privilege attackers can enumerate sequential document ids to retrieve body and draft content of private documents and restricted library, product, project, or team documents.
This page as .md · .json · in your agent: get_signal("CVE-2026-119645")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.