CVE-2026-119645

ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc that allows authenticated users to read documents without checkPrivDoc access checks. Low-privilege attackers can enumerate sequential document ids to retrieve body and draft content of private documents and...

CVE-2026-119645 ZenTao PMS through 22.6 Missing Authorization via doc.ajaxGetDoc

ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc that allows authenticated users to read documents without checkPrivDoc access checks. Low-privilege attackers can enumerate sequential document ids to retrieve body and draft content of private documents and...

CVE-2026-119645 ZenTao PMS through 22.6 Missing Authorization via doc.ajaxGetDoc

ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc that allows authenticated users to read documents without checkPrivDoc access checks. Low-privilege attackers can enumerate sequential document ids to retrieve body and draft content of private documents and...

CVE-2026-119645

ZenTao PMS versions up to 22.6 are vulnerable to a missing authorization flaw in the doc::ajaxGetDoc() function. The root cause is the omission of checkPrivDoc() access checks, allowing authenticated low-privilege users to bypass permission controls. By enumerating sequential document IDs, an att...

EUVD-2026-114061

ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc that allows authenticated users to read documents without checkPrivDoc access checks. Low-privilege attackers can enumerate sequential document ids to retrieve body and draft content of private documents and...

PT-2026-133575

ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc that allows authenticated users to read documents without checkPrivDoc access checks. Low-privilege attackers can enumerate sequential document ids to retrieve body and draft content of private documents and...

CVE-2026-119645: easysoft zentaopms: ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated…

ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc that allows authenticated users to read documents without checkPrivDoc access checks. Low-privilege attackers can enumerate sequential document ids to retrieve body and draft content of private documents and...