{"id":"CVE-2026-125747","kind":"vulnerability","aliases":["CVE-2026-125747"],"related":[],"title":"ZenTao PMS: authenticated users can edit builds in other projects","description":"ZenTao PMS through 22.7 contains a missing object-level authorization vulnerability in module/build/control.php that allows authenticated users to modify builds in projects they do not belong to. Attackers holding build privileges in any project can supply sequential buildID values to delete, edit, or relink stories and bugs on builds in foreign or private projects.","summary":"ZenTao PMS through version 22.7 does not check object ownership in its build module, so a logged-in user can change builds in projects they do not belong to. An attacker with build privileges in any project can delete, edit, or relink stories and bugs on builds in private projects.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","project-management","self-hosted","zentao"],"not_affected_if":["auth-required","no-build-privileges"],"how_to_check":"- Check the installed ZenTao PMS version and whether it is `22.7` or earlier.\n- Review which users hold build privileges in any project.","fix":null,"status":"open","published_at":"2026-11-10T16:17:20+00:00","first_seen_at":"2026-11-10T16:22:34+00:00","triaged_at":"2026-11-10T16:23:37+00:00","updated_at":"2026-11-10T16:23:37+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-10T16:23:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"ZenTao PMS: authenticated users can edit builds in other projects","impact":"medium","summary":"ZenTao PMS through version 22.7 does not check object ownership in its build module, so a logged-in user can change builds in projects they do not belong to. An attacker with build privileges in any project can delete, edit, or relink stories and bugs on builds in private projects.","audience":"businesses","category":"other","nicknames":[],"who_cares":["zentao","self-hosted","project-management"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker deletes or alters build data in private projects","analyst_note":"Confirm the fixed version in the vendor advisory at www.vulncheck.com and whether a patch exists for ZenTao PMS.","how_to_check":"- Check the installed ZenTao PMS version and whether it is `22.7` or earlier.\n- Review which users hold build privileges in any project.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["auth-required","no-build-privileges"],"who_is_affected":"ZenTao PMS installations up to and including 22.7 where users have accounts and build privileges in at least one project. The flaw lets such users reach builds in projects they are not members of, so teams with private projects are the most exposed. Instances where all users belong to every project carry less risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000716,"input_tokens":4589,"output_tokens":515,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125747':13A,16A '-2026':12A,15A '22.7':29B,79C 'allow':91C 'attack':56B,104C 'authent':3A,92C 'author':86C 'belong':53B,102C 'bug':70B,123C 'build':7A,37B,47B,58B,72B,96C,106C,125C 'buildid':114C 'chang':46B 'check':32B 'contain':80C 'cve':11A,14A 'delet':64B,117C 'edit':6A,65B,118C 'foreign':127C 'hold':105C 'host':23B 'level':85C 'log':42B 'logged-in':41B 'manag':20B 'miss':82C 'modifi':95C 'modul':38B 'module/build/control.php':89C 'object':33B,84C 'object-level':83C 'ownership':34B 'pms':2A,26B,77C 'privat':74B,129C 'privileg':59B,107C 'project':10A,19B,49B,62B,75B,98C,110C,130C 'project-manag':18B 'relink':67B,120C 'self':22B 'self-host':21B 'sequenti':113C 'stori':68B,121C 'suppli':112C 'user':4A,44B,93C 'valu':115C 'version':28B 'vulner':87C 'zentao':1A,24B,25B,76C","nicknames":[],"mitigations":[],"who_affected":"ZenTao PMS installations up to and including 22.7 where users have accounts and build privileges in at least one project. The flaw lets such users reach builds in projects they are not members of, so teams with private projects are the most exposed. Instances where all users belong to every project carry less risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","other","projectmanagement","selfhosted","zentao"],"campaign_type":null,"search_a":"'-125747':13A,16A '-2026':12A,15A 'authent':3A 'build':7A 'cve':11A,14A 'edit':6A 'pms':2A 'project':10A 'user':4A 'zentao':1A","search_b":"'22.7':29B 'attack':56B 'belong':53B 'bug':70B 'build':37B,47B,58B,72B 'chang':46B 'check':32B 'delet':64B 'edit':65B 'host':23B 'log':42B 'logged-in':41B 'manag':20B 'modul':38B 'object':33B 'ownership':34B 'pms':26B 'privat':74B 'privileg':59B 'project':19B,49B,62B,75B 'project-manag':18B 'relink':67B 'self':22B 'self-host':21B 'stori':68B 'user':44B 'version':28B 'zentao':24B,25B","search_c":"'22.7':79C 'allow':91C 'attack':104C 'authent':92C 'author':86C 'belong':102C 'bug':123C 'build':96C,106C,125C 'buildid':114C 'contain':80C 'delet':117C 'edit':118C 'foreign':127C 'hold':105C 'level':85C 'miss':82C 'modifi':95C 'module/build/control.php':89C 'object':84C 'object-level':83C 'pms':77C 'privat':129C 'privileg':107C 'project':98C,110C,130C 'relink':120C 'sequenti':113C 'stori':121C 'suppli':112C 'user':93C 'valu':115C 'vulner':87C 'zentao':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125747","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125747","severity":null,"published_at":"2026-11-10T16:17:20+00:00","modified_at":"2026-11-10T16:17:20+00:00","first_seen_at":"2026-11-10T16:22:34+00:00","fetched_at":"2026-11-10T16:22:34+00:00","note":null}],"documents":[{"id":116108,"url":"https://www.vulncheck.com/advisories/zentao-pms-through-22.7-idor-via-build-module-mutation-methods","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}