CVE-2026-111346 Details

An authorization bypass vulnerability has been identified in ZenTao PMS versions through 22.6, specifically within the action::editComment function. This vulnerability allows authenticated users to read and overwrite comments belonging to other users by providing a chosen actionID. Exploitation involves sequentially iterating through action IDs to alter comments on various work items, including bugs, stories, tasks, and documents, across inaccessible products and projects. The vulnerability also enables viewing of the targeted comment content and any attached files.

The vulnerability can be fixed by adding object-access checks in the 'editComment' method to ensure that users can only edit or read comments they authored or have access to. This can be done by reusing existing privilege check functions that verify object access based on the user's membership and rights.