CVE-2026-119645
ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that…
- Risk score
- 46/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 30 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated users to read documents without checkPrivDoc() access checks. Low-privilege attackers can enumerate sequential document ids to retrieve body and draft content of private documents and restricted librar…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.5 medium
References
- https://github.com/easysoft/zentaopms
- https://github.com/easysoft/zentaopms/blob/zentaopms_22.6_20260917/module/doc/control.php#L2524-L2589
- https://github.com/easysoft/zentaopms/issues/215
- https://hackmd.io/@hieuPenguinnn/zentaopms-doc-ajaxgetdoc-private-doc-disclosure-idor
- https://www.vulncheck.com/advisories/zentao-pms-through-22.6-missing-authorization-via-doc-ajaxgetdoc
Original description
ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated users to read documents without checkPrivDoc() access checks. Low-privilege attackers can enumerate sequential document ids to retrieve body and draft content of private documents and restricted library, product, project, or team documents.
Last activity 30 Oct 2026. Patch Forecast updates every hour.