CVE-2026-111346 in ZenTao PMS
Summary
by MITRE • 10/16/2026
ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users' comments by supplying an arbitrary actionID. Attackers can iterate sequential action ids to modify comments on bugs, stories, tasks, and documents in products and projects they cannot access, and view targeted comment content and attachments.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in ZenTao Project Management System versions up to 22.6 represents a critical failure in server-side authorization logic within the action::editComment functionality. This flaw allows authenticated users to bypass intended access controls by manipulating input parameters, specifically through the supply of arbitrary or sequential action IDs. In a properly secured application, every request to modify or view sensitive data must be validated against the user's permissions for that specific resource. However, in this instance, the system fails to verify whether the requesting user has ownership or explicit permission rights over the comment associated with the provided action ID. This architectural weakness effectively decouples the authentication layer from the authorization logic, creating a pathway for unauthorized access and modification of data across the platform.
From a technical perspective, the exploitation mechanism relies on the predictability and sequential nature of identifiers used by the application to reference comments within bugs, stories, tasks, and documents. Because these action IDs are often generated in an incremental sequence, attackers can employ automated scripts to iterate through potential ID values systematically. By submitting requests with different action IDs while maintaining a valid session token, the attacker can probe various resources until they find one where the server processes the request without returning an access denied error. This process allows the adversary to read comment content and download attachments associated with items in products or projects that are strictly restricted from their view according to role-based permissions. The ability to overwrite these comments further escalates the severity, as it enables data integrity violations alongside confidentiality breaches.
The operational impact of this vulnerability is significant for organizations relying on ZenTao for collaborative project management and software development workflows. Unauthorized access to private discussions can lead to the leakage of sensitive architectural decisions, security findings, or proprietary business logic contained within comments and attached files. Furthermore, the capability to overwrite existing comments introduces a risk of data corruption and social engineering attacks where attackers might alter historical records to mislead team members or cover their tracks after an initial compromise. This erosion of trust in the system's integrity can disrupt project timelines and lead to incorrect technical implementations based on manipulated information. The vulnerability affects multiple modules including bugs, stories, tasks, and documents, thereby expanding the attack surface across various stages of the software development lifecycle managed within the platform.
This flaw aligns with CWE-284 Improper Access Control, specifically reflecting a failure in enforcing proper authorization checks for specific actions on objects owned by other users. It also maps to MITRE ATT&CK technique T1078 Valid Accounts, as it requires initial authentication but then abuses those credentials to access resources beyond their intended scope. To mitigate this risk, administrators should immediately apply the vendor-patched version of ZenTao which addresses the authorization check in the editComment action. In environments where patching is not immediately feasible, network-level controls such as Web Application Firewalls can be configured to detect and block requests exhibiting patterns consistent with ID enumeration attacks, although this is a less robust defense than fixing the underlying code logic. Regular audits of access control implementations are recommended to ensure that all API endpoints and UI actions strictly validate user permissions against resource ownership before processing any data modification or retrieval operations.