---
id: "CVE-2026-125747"
page: "https://infrastack.ai/live/CVE-2026-125747"
kind: "vulnerability"
aliases: ["CVE-2026-125747"]
title: "ZenTao PMS: authenticated users can edit builds in other projects"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "project-management", "self-hosted", "zentao"]
not_affected_if: ["auth-required", "no-build-privileges"]
published_at: "2026-11-10T16:17:20+00:00"
first_seen_at: "2026-11-10T16:22:34+00:00"
updated_at: "2026-11-10T16:23:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125747", "first_seen_at": "2026-11-10T16:22:34+00:00"}]
exploit_sources: []
---

# ZenTao PMS: authenticated users can edit builds in other projects

Link for people: https://infrastack.ai/live/CVE-2026-125747 (this .md is for agents)

ZenTao PMS through version 22.7 does not check object ownership in its build module, so a logged-in user can change builds in projects they do not belong to. An attacker with build privileges in any project can delete, edit, or relink stories and bugs on builds in private projects.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed ZenTao PMS version and whether it is `22.7` or earlier.
- Review which users hold build privileges in any project.

## Timeline

- 2026-11-10T16:22:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125747

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/zentao-pms-through-22.7-idor-via-build-module-mutation-methods

## From the sources

ZenTao PMS through 22.7 contains a missing object-level authorization vulnerability in module/build/control.php that allows authenticated users to modify builds in projects they do not belong to. Attackers holding build privileges in any project can supply sequential buildID values to delete, edit, or relink stories and bugs on builds in foreign or private projects.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_