---
id: "CVE-2026-119645"
kind: "vulnerability"
aliases: ["CVE-2026-119645"]
title: "ZenTao PMS: missing access check lets logged-in users read private documents"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "zentaopms", "fixed": [], "affected": "<= 22.6", "ecosystem": "vendor"}]
ecosystems: []
tags: ["authenticated", "package", "project-management", "self-hosted", "zentao"]
not_affected_if: ["single-user-instance"]
published_at: "2026-10-30T15:16:47+00:00"
first_seen_at: "2026-10-30T15:31:10+00:00"
updated_at: "2026-10-30T15:34:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119645", "first_seen_at": "2026-10-30T15:31:10+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-30T15:34:57+00:00"}]
---

# ZenTao PMS: missing access check lets logged-in users read private documents

ZenTao PMS through 22.6 skips its document permission check in doc::ajaxGetDoc(), so any logged-in user can read documents they should not see. An attacker can enumerate sequential document ids to pull body and draft text from private and restricted library, product, project, or team documents.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:zentaopms affected <= 22.6 fixed ?

## How to check

Check the ZenTao version (admin panel, or the release tag in the install). 22.6 and earlier are affected. To test: log in as a low-privilege user and request /index.php?m=doc&f=ajaxGetDoc&docID=<id of a private doc you cannot open in the UI>; a JSON response with the doc body means exposed. Check web logs for one account requesting ajaxGetDoc with many sequential docID values.

## Timeline

- 2026-10-30T15:31:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119645
- 2026-10-30T15:34:57+00:00 analyst — Read VulnCheck advisory and reporter write-up (static review, no runtime test). No vendor advisory or fixed version found; 22.6 (zentaopms_22.6_20260917) is latest tag known; GitHub issue #215 unreadable. Fix left unknown, nothing marked verified. No PoC/exploitation seen.

## Documents

- [advisory] VulnCheck: ZenTao PMS through 22.6 Missing Authorization via doc.ajaxGetDoc https://www.vulncheck.com/advisories/zentao-pms-through-22.6-missing-authorization-via-doc-ajaxgetdoc
- [describes] Reporter write-up: doc.ajaxGetDoc IDOR (static review, not runtime-tested) https://hackmd.io/@hieuPenguinnn/zentaopms-doc-ajaxgetdoc-private-doc-disclosure-idor

## From the sources

ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated users to read documents without checkPrivDoc() access checks. Low-privilege attackers can enumerate sequential document ids to retrieve body and draft content of private documents and restricted library, product, project, or team documents.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_