CVE-2026-125747 · Other
NO FIX YET
ZenTao PMS through version 22.7 does not check object ownership in its build module, so a logged-in user can change builds in projects they do not belong to. An attacker with build privileges in any project can delete, edit, or relink stories and bugs on builds in private projects.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
ZenTao PMS installations up to and including 22.7 where users have accounts and build privileges in at least one project. The flaw lets such users reach builds in projects they are not members of, so teams with private projects are the most exposed. Instances where all users belong to every project carry less risk.
Not affected if auth-required, no-build-privileges
Who cares project-management, self-hosted, zentao
22.7 or earlier.No fix yet, per the sources.
ZenTao PMS through 22.7 contains a missing object-level authorization vulnerability in module/build/control.php that allows authenticated users to modify builds in projects they do not belong to. Attackers holding build privileges in any project can supply sequential buildID values to delete, edit, or relink stories and bugs on builds in foreign or private projects.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.