{"id":"CVE-2026-111346","summary":"ZenTao PMS through 22.6 Authorization Bypass via action::editComment","details":"ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users' comments by supplying an arbitrary actionID. Attackers can iterate sequential action ids to modify comments on bugs, stories, tasks, and documents in products and projects they cannot access, and view targeted comment content and attachments.","modified":"2026-10-21T02:55:10.737470379Z","published":"2026-10-15T21:43:37.962Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-639"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111346.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111346.json"},{"type":"ADVISORY","url":"https://hackmd.io/@hieuPenguinnn/zentaopms-action-editcomment-cross-user-idor"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111346"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/zentao-pms-through-22.6-authorization-bypass-via-action-editcomment"},{"type":"PACKAGE","url":"https://github.com/easysoft/zentaopms"},{"type":"ARTICLE","url":"https://github.com/easysoft/zentaopms/blob/zentaopms_22.6_20260917/module/action/control.php#L384-L426"},{"type":"ARTICLE","url":"https://github.com/easysoft/zentaopms/blob/zentaopms_22.6_20260917/module/action/model.php#L2025-L2057"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/easysoft/zentaopms","events":[{"introduced":"0"},{"last_affected":"d5bfff8c91cea48018275381e0a127ed6fa5c79f"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"0"},{"last_affected":"22.6"}]},{"range":[{"introduced":"0"},{"last_affected":"22.6"}],"source":"DESCRIPTION"}]}}],"versions":["zentaopms_22.6_20260917","zentaopms_22.3_20260707","zentaopms_22.2_20260527","zentaopms_21.6_20250414","zentaopms_21.6_20250411","zentaopms_21.6.beta_20250321","zentaopms_21.5_20250307","zentaopms_21.5_20250306","zentaopms_21.4_20250115","zentaopms_21.3_20241227","zentaopms_21.2_20241205","zentaopms_21.0_20241106","zentaopms_21.0_20241104","zentaopms_20.8_20241022","zentaopms_20.7.1_20240930","zentaopms_20.7_20240914","zentaopms_20.6_20240902","zentaopms_20.6_20240830","zentaopms_20.5_20240819","zentaopms_20.5_20240816","zentaopms_20.4_20240805","zentaopms_20.4_20240803","zentaopms_20.4_20240802","zentaopms_20.3.0_20240722","zentaopms_20.2.0_20240710","zentaopms_20.1.1_20240614","zentaopms_20.0.beta1","zentaopms_18.3","zentaopms_18.1","zentaopms_18.0.beta2","zentaopms_18.0.beta1","zentaopms_17.8","zentaopms_17.7","zentaopms_17.6.2","zentaopms_17.6","zentaopms_17.1","zentaopms_17.0","zentaopms_16.5.beta1","zentaopms_16.4","zentaopms_16.3","zentaopms_16.2","zentaopms_16.0","zentaopms_16.0.beta1","zentaopms_16.0.beta1_20211207","zentaopms_15.8_20211122","zentaopms_15.7.1_20211102","zentaopms_15.5_20210914","zentaopms_15.4_20210823","zentaopms_15.3_20210804","zentaopms_15.2_20210720","zentaopms_15.0.1_20210606","zentaopms_20.0.beta4_20210202","zentaopms_13.0.beta4_20210202","zentaopms_20.beta2_20201218","zentaopms_13.beta2_20201218","zentaopms_20.0.beta1_20201201","zentaopms_13.0.beta1_20201201","zentaopms_20.0.alpha2_20201123","zentaopms_13.0.alpha2_20201123","zentaopms_13.0.alpha1_20201103","zentaopms_20.0.alpha1_20201103","zentaopms_20.0.alpha_20201030_1","zentaopms_20.0._20201022","zentaopms_13.0._20201022","zentaopms_12.3.3_20200707","zentaopms_12.3.2_20200601","zentaopms_12.0.stable_20200103","zentaopms_11.7.stable_20191129","zentaopms_11.6.4_20191017","zentaopms_11.6.3_20190924","zentaopms_11.6.2_20190906","zentaopms_11.6.1_20190823","zentaopms_11.6.0.beta1_20190705","zentaopms_11.4.stable_20190325","zentaopms_11.5.stable_20190508","zentao_11.2_build1_20190128","zentaopms_11.1.stable_20190104","zentaopms_11.0.stable_20181221","zentaopms_10.6.stable_20181120","zentaopms_10.5.1_20181105","zentaopms_10.4.stable_20180928","zentaopms_10.3.1_20180907","zentaopms_10.3_20170809","zentaopms_10.1_20180716","zentaopms_9.6.1_20171113","zentaopms_9.6_20171106","zentaopms_9.5.1_20170927","zentaopms_9.4_20170726","zentaopms_9.3.beta_20170627","zentaopms_9.2.1_20170522","zentaopms_9.2.stable_20170516","zentaopms_9.1.2_20170419","zentaopms_9.1.1_20170410","zentaopms_9.0.1_20170215","zentaopms_9.0.stable_20170117","zentaopms_8.4.1_20161212","zentaopms_8.4.stable_20161206","zentaopms_8.3.stable_20161109","zentaopms_8.2.6_20160913","zentaopms_8.2.5_20160805","zentaopms_8.2.4_20160628","zentaopms_8.3.4_20160628","zentaopms_8.2.3_20160624","zentaopms_8.2.2_20160608","zentaopms_8.2.1_20160524","zentaopms_8.2.stable_20160517","zentaopms_8.2.beta_20160504","zentaopms_8.1.3_20160323","zentaopms_8.1.stable_20160315","zentaopms_8.0.1_20151224","zentaopms_8.0.stable_20151127","zentaopms_7.3.stable_20150918","zentaopms_7.2.5_20150807","zentaopms_7.2.4_20150703","zentaopms_7.2.stable_20150525","zentaopms_7.1.stable_20150317","zentaopms_7.0.stable_20150206","zentaopms_6.4.stable_20141223","zentaopms_6.3.stable_20141107","zentaopms_6.2.stable_20140827","zentaopms_6.1.stable_20140806","zentaopms_6.1.stable_20140805","zentaopms_6.0.stable_20140625","zentaopms_6.0.beta1_20140503","zentaopms_5.0.beta1_20130809","zentaopms_4.3.beta_20130805"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111346.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}]}