What’s Vulnerable › Vulnerabilities

CVE-2026-111346: ZenTao PMS through 22.6 Authorization Bypass via action::editComment

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-15 · updated 2026-10-16
• Weakness: CWE-639

Description

ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users' comments by supplying an arbitrary actionID. Attackers can iterate sequential action ids to modify comments on bugs, stories, tasks, and documents in products and projects they cannot access, and view targeted comment content and attachments.

Affected products

• easysoft zentaopms: through 22.6

References

• https://github.com/easysoft/zentaopms
• https://github.com/easysoft/zentaopms/blob/zentaopms_22.6_20260917/module/action/control.php#L384-L426
• https://github.com/easysoft/zentaopms/blob/zentaopms_22.6_20260917/module/action/model.php#L2025-L2057
• https://hackmd.io/@hieuPenguinnn/zentaopms-action-editcomment-cross-user-idor
• https://www.vulncheck.com/advisories/zentao-pms-through-22.6-authorization-bypass-via-action-editcomment
• https://hackmd.io/@hieuPenguinnn/zentaopms-action-editcomment-cross-user-idor

Get alerted when CVE-2026-111346 or the next vulnerability affects your stack