---
id: CVE-2026-111346
title: >-
  ZenTao PMS through 22.6 contains an authorization bypass vulnerability in
  action::editComment that allows authenticated users to read and overwrite
  other users' comments by supplying an arbitrary actionID
summary: >-
  ZenTao PMS through 22.6 contains an authorization bypass vulnerability in
  action::editComment that allows authenticated users to read and overwrite
  other users' comments by supplying an arbitrary actionID. Attackers can
  iterate sequentia…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-639
vendor: easysoft
product: zentaopms
affected:
  - zentaopms <= 22.6
published: '2026-10-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:25:45.343'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-111346'
references:
  - url: 'https://github.com/easysoft/zentaopms'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/easysoft/zentaopms/blob/zentaopms_22.6_20260917/module/action/control.php#L384-L426
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/easysoft/zentaopms/blob/zentaopms_22.6_20260917/module/action/model.php#L2025-L2057
    label: disclosure@vulncheck.com
  - url: >-
      https://hackmd.io/@hieuPenguinnn/zentaopms-action-editcomment-cross-user-idor
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/zentao-pms-through-22.6-authorization-bypass-via-action-editcomment
    label: disclosure@vulncheck.com
  - url: >-
      https://hackmd.io/@hieuPenguinnn/zentaopms-action-editcomment-cross-user-idor
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00294
epssPercentile: 0.21841
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T16:46:07.691798Z'
ingestedAt: '2026-10-15T22:48:25.455Z'
---

## Overview

ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users' comments by supplying an arbitrary actionID. Attackers can iterate sequential action ids to modify comments on bugs, stories, tasks, and documents in products and projects they cannot access, and view targeted comment content and attachments.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.