Vulnerability · Published Oct 15, 2026 · Assigned by VulnCheck

CVE-2026-111346ZenTao PMS through 22.6 Authorization Bypass via action::editComment

Medium 5.4

In plain English

A medium-severity authorization bypass via user-controlled key in zentaopms from easysoft. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 77.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users' comments by supplying an arbitrary actionID. Attackers can iterate sequential action ids to modify comments on bugs, stories, tasks, and documents in products and projects they cannot access, and view targeted comment content and attachments.

Affected products (as reported)

Vendor	Product	Versions
easysoft	zentaopms	0 – through 22.6

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

https://hackmd.io/@hieuPenguinnn/zentaopms-action-editcomment-cross-user-idor third-party-advisory
https://github.com/easysoft/zentaopms/blob/zentaopms_22.6_20260917/module/action/control.php#L384-L426 technical-description
https://github.com/easysoft/zentaopms/blob/zentaopms_22.6_20260917/module/action/model.php#L2025-L2057 technical-description
https://github.com/easysoft/zentaopms product
VulnCheck Advisory: ZenTao PMS through 22.6 Authorization Bypass via action::editComment third-party-advisory