{"id":"CVE-2026-119645","kind":"vulnerability","aliases":["CVE-2026-119645"],"related":[],"title":"ZenTao PMS: missing access check lets logged-in users read private documents","description":"ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated users to read documents without checkPrivDoc() access checks. Low-privilege attackers can enumerate sequential document ids to retrieve body and draft content of private documents and restricted library, product, project, or team documents.","summary":"ZenTao PMS through 22.6 skips its document permission check in doc::ajaxGetDoc(), so any logged-in user can read documents they should not see. An attacker can enumerate sequential document ids to pull body and draft text from private and restricted library, product, project, or team documents.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"zentaopms","fixed":[],"affected":"<= 22.6","ecosystem":"vendor"}],"ecosystems":[],"tags":["authenticated","package","project-management","self-hosted","zentao"],"not_affected_if":["single-user-instance"],"how_to_check":"Check the ZenTao version (admin panel, or the release tag in the install). 22.6 and earlier are affected. To test: log in as a low-privilege user and request /index.php?m=doc&f=ajaxGetDoc&docID=<id of a private doc you cannot open in the UI>; a JSON response with the doc body means exposed. Check web logs for one account requesting ajaxGetDoc with many sequential docID values.","fix":null,"status":"open","published_at":"2026-10-30T15:16:47+00:00","first_seen_at":"2026-10-30T15:31:10+00:00","triaged_at":"2026-10-30T15:33:28+00:00","updated_at":"2026-10-30T15:34:57+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T15:33:28Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"ZenTao PMS: missing access check lets logged-in users read private documents","impact":"medium","summary":"ZenTao PMS through 22.6 skips its document permission check in doc::ajaxGetDoc(), so any logged-in user can read documents they should not see. An attacker can enumerate sequential document ids to pull body and draft text from private and restricted library, product, project, or team documents.","audience":"businesses","category":"package","nicknames":[],"who_cares":["zentao","self-hosted","project-management"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"logged-in users read private and restricted documents","analyst_note":"Check the NVD entry and ZenTao's vendor advisory for the fixed version and whether a patch exists; the sources here do not state a fix.","how_to_check":"- Confirm the installed ZenTao PMS version, for example by checking the version shown in the admin panel, and compare it against `22.6`.\n- Review whether user accounts with low privileges can open documents they do not own through the document pages.","plain_action":"","needs_analyst":true,"not_affected_if":["single-user-instance"],"who_is_affected":"Teams that run a self-hosted ZenTao PMS instance (through 22.6) with multiple user accounts, where low-privilege users have login access. The sources do not say whether the flaw is reachable on instances with only a single trusted user. unknown whether the issue is limited to specific document types or configurations beyond the described restricted libraries and teams.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.0007,"input_tokens":4148,"output_tokens":570,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and ZenTao's vendor advisory for the fixed version and whether a patch exists; the sources here do not state a fix.","search":"'-119645':16A,19A '-2026':15A,18A '22.6':33B,81C 'access':4A,99C 'ajaxgetdoc':41B,89C 'allow':91C 'attack':56B,104C 'authent':21B,92C 'author':85C 'bodi':64B,112C 'check':5A,38B,100C 'checkprivdoc':98C 'contain':82C 'content':115C 'cve':14A,17A 'doc':40B,88C 'document':13A,36B,50B,60B,77B,96C,108C,118C,126C 'draft':66B,114C 'enumer':58B,106C 'host':28B 'id':61B,109C 'let':6A 'librari':72B,121C 'log':8A,45B 'logged-in':7A,44B 'low':102C 'low-privileg':101C 'manag':25B 'miss':3A,84C 'packag':22B 'permiss':37B 'pms':2A,31B,79C 'privat':12A,69B,117C 'privileg':103C 'product':73B,122C 'project':24B,74B,123C 'project-manag':23B 'pull':63B 'read':11A,49B,95C 'restrict':71B,120C 'retriev':111C 'see':54B 'self':27B 'self-host':26B 'sequenti':59B,107C 'skip':34B 'team':76B,125C 'text':67B 'user':10A,47B,93C 'vulner':86C 'without':97C 'zentao':1A,29B,30B,78C 'zentaopms':20A","nicknames":[],"mitigations":[],"who_affected":"Self-hosted ZenTao PMS up to and including 22.6 with more than one user. Any logged-in account, including a low-privilege one, can read the body and drafts of private or team-restricted documents by guessing sequential document ids. Single-user instances, or ones where every user may see every document, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T15:16:47+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119645","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119645","severity":null,"published_at":"2026-10-30T15:16:47+00:00","modified_at":"2026-10-30T15:16:47+00:00","first_seen_at":"2026-10-30T15:31:10+00:00","fetched_at":"2026-10-30T15:31:10+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119645:1169","url":null,"severity":null,"published_at":"2026-10-30T15:34:57+00:00","modified_at":"2026-10-30T15:34:57+00:00","first_seen_at":"2026-10-30T15:34:57+00:00","fetched_at":"2026-10-30T15:34:57+00:00","note":"Read VulnCheck advisory and reporter write-up (static review, no runtime test). No vendor advisory or fixed version found; 22.6 (zentaopms_22.6_20260917) is latest tag known; GitHub issue #215 unreadable. Fix left unknown, nothing marked verified. No PoC/exploitation seen."}],"documents":[{"id":24331,"url":"https://www.vulncheck.com/advisories/zentao-pms-through-22.6-missing-authorization-via-doc-ajaxgetdoc","title":"VulnCheck: ZenTao PMS through 22.6 Missing Authorization via doc.ajaxGetDoc","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":24332,"url":"https://hackmd.io/@hieuPenguinnn/zentaopms-doc-ajaxgetdoc-private-doc-disclosure-idor","title":"Reporter write-up: doc.ajaxGetDoc IDOR (static review, not runtime-tested)","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}