EUVD-2026-102490

ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users' comments by supplying an arbitrary actionID. Attackers can iterate sequential action ids to modify comments on bugs, stories, tasks, and...

CVE-2026-111346

ZenTao PMS versions through 22.6 are vulnerable to an authorization bypass in the action::editComment function. By supplying an arbitrary actionID , authenticated users can read and overwrite comments belonging to other users. Attackers can iterate through sequential IDs to modify comments on bug...