CVE-2026-119645
ZenTao PMS through 22.6 Missing Authorization via doc.ajaxGetDoc
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated users to read documents without checkPrivDoc() access checks. Low-privilege attackers can enumerate sequential document ids to retrieve body and draft content of private documents and restricted library, product, project, or team documents.
| CWE | CWE-639 |
| Vendor | easysoft |
| Product | zentaopms |
| Published | Oct 30, 2026 |
| Last Updated | Oct 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for easysoft zentaopms
Be the first to know when new medium vulnerabilities affecting easysoft zentaopms are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
easysoft / zentaopms
0 ≤ 22.6
References
github.com: https://github.com/easysoft/zentaopms/issues/215 github.com: https://github.com/easysoft/zentaopms/blob/zentaopms_22.6_20260917/module/doc/control.php#L2524-L2589 hackmd.io: https://hackmd.io/@hieuPenguinnn/zentaopms-doc-ajaxgetdoc-private-doc-disclosure-idor github.com: https://github.com/easysoft/zentaopms vulncheck.com: https://www.vulncheck.com/advisories/zentao-pms-through-22.6-missing-authorization-via-doc-ajaxgetdoc
Credits
hieuPenguinnn