ZenTao PMS through 22.6 Missing Authorization via doc.ajaxGetDoc
ZenTao PMS 22.6 and earlier lets any logged-in account read any document by id, including private and restricted ones. No vendor rating is given. Fixed in 22.7.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 22.7
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
ZenTao PMS, a project management application, is affected by a missing authorization flaw in its document retrieval function. Logged-in users with low privileges can read private or restricted documents, including their body and draft content, from libraries, products, projects, or teams they should not have access to.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated users to read documents without checkPrivDoc() access checks. Low-privilege attackers can enumerate sequential document ids to retrieve body and draft content of private documents and restricted library, product, project, or team documents.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- easysoft zentaopms
through 22.6
References 5
Questions about CVE-2026-119645
What does this mean?
The doc.ajaxGetDoc endpoint checks only that a user is logged in, not whether that user may see the document. A logged-in account can therefore read the full body and metadata of any document by id, including private documents, restricted library, product, project or team documents, and draft bodies.Source: github.com, hackmd.io
Am I affected, and how do I check?
ZenTao PMS 22.6 (latest release) and earlier versions are affected, under the default configuration. To check the installed version, compare the ZenTao PMS version number against 22.6 or earlier.Source: github.com, hackmd.io
What should I do about it?
Upgrade to ZenTao PMS 22.7, the version the vendor says will fix this issue. The facts list no workaround for versions before the fix.Source: github.com, hackmd.io
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data