CVE-2026-111346

MediumCVSS 5.4/10Last modified Oct 16, 2026

Description

ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users' comments by supplying an arbitrary actionID. Attackers can iterate sequential action ids to modify comments on bugs, stories, tasks, and documents in products and projects they cannot access, and view targeted comment content and attachments.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Oct 15, 2026
Last modified: Oct 16, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1113475.9go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted login passwords CVE-2026-1113485.4Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenti CVE-2026-1113495.3Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to CVE-2026-111356.5Insufficient policy enforcement in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary access CVE-2026-1113505.0Papermark through 0.22.0 contains a missing authorization vulnerability in the data room viewer group API that allows authenticated users to CVE-2026-1113514.2metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows authenticated low-pr CVE-2026-1113528.8ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administr CVE-2026-1113534.3Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attach CVE-2026-1113543.1crmeb_java through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members' orders by sup CVE-2026-1113556.3zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to ignore department DataSc CVE-2026-1113567.4MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to tak CVE-2026-1113577.0Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege e