Authorization Bypass Vulnerability in ZenTao PMS by Easysoft

CVE-2026-111346

What is CVE-2026-111346?

ZenTao PMS versions up to 22.6 contain a vulnerability that allows authenticated users to bypass authorization controls through the action::editComment method. This flaw enables users to read and overwrite comments made by others by simply providing a specific actionID. By exploiting this vulnerability, malicious actors can manipulate comments related to bugs, stories, tasks, and documents in inaccessible projects, as well as gain access to sensitive comment content and attachments. This circumvention of intended access restrictions poses a significant security risk and underscores the importance of robust user access controls.

References