SZB-a9ba90ad42
ZenTao PMS missing authorization exposes documents, EUVD-2026-114061
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Easysoft
- Product
- ZenTao PMS
- First seen
Summary
The EUVD record EUVD-2026-114061 describes a missing authorization vulnerability in doc::ajaxGetDoc() in ZenTao PMS through 22.6, with a CVSS v3.1 score of 7.1. It says low-privilege users can enumerate sequential document IDs to read documents.
If you use Easysoft
Update ZenTao PMS to a version later than 22.6
Review document access logs for sequential ID enumeration
Confirm sensitive documents are not stored in the affected system until patched
What the sources say 1
· Mastodon: “ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated users to read documents without checkPrivDoc() access checks.” Source