Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck

CVE-2026-119645ZenTao PMS through 22.6 Missing Authorization via doc.ajaxGetDoc

Medium 6.5

In plain English

A medium-severity authorization bypass via user-controlled key in zentaopms from easysoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 66.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated users to read documents without checkPrivDoc() access checks. Low-privilege attackers can enumerate sequential document ids to retrieve body and draft content of private documents and restricted library, product, project, or team documents.

Affected products (as reported)

Vendor	Product	Versions
easysoft	zentaopms	0 – through 22.6

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/easysoft/zentaopms/issues/215 issue-tracking
https://github.com/easysoft/zentaopms/blob/zentaopms_22.6_20260917/module/doc/control.php#L2524-L2589 technical-description
https://hackmd.io/@hieuPenguinnn/zentaopms-doc-ajaxgetdoc-private-doc-disclosure-idor third-party-advisory
https://github.com/easysoft/zentaopms product
VulnCheck Advisory: ZenTao PMS through 22.6 Missing Authorization via doc.ajaxGetDoc third-party-advisory