ZenTao PMS CVE-2026-119645

Requires a valid authenticated account on ZenTao PMS at or below version 22.6, consistent with CVSS PR:L - the attacker must already be able to log in, even at low privilege. The specific trigger is the doc::ajaxGetDoc() handler in module/doc/control.php, which retrieves document content without invoking the checkPrivDoc() access-control check; exploitation works against default behavior of that endpoint and needs no user interaction (UI:N) and no special configuration. Impact is limited to confidentiality (reading body and draft content of private/restricted documents) via enumeration of sequential document IDs; the main limiting factor is the need for authentication, so exposure scales with how many low-privilege accounts exist and whether the instance is internet-reachable.

This is a genuine but bounded-priority issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) describes a network-reachable, low-complexity flaw requiring only low-privilege authentication (PR:L) and no user interaction, with high confidentiality impact and zero integrity or availability impact - consistent with a read-only IDOR (CWE-639). The vuln.today decision label is 'this_week', reported by VulnCheck, which signals meaningful but non-emergency urgency rather than act_now/emergency. No CISA KEV listing and no EPSS score are provided in the input, so there is no signal of active or widespread exploitation; however, the input references include a detailed public technical write-up (hackmd) and the upstream issue, so a public PoC reference exists. The practical risk is driven by how trivial post-authentication exploitation is: any valid low-privilege user can enumerate sequential document IDs to harvest private content. This is not an inflated high-CVSS-but-low-real-risk finding for environments where many users hold accounts, but its impact is confined to confidentiality disclosure - there is no code execution, data modification, or service disruption. Missing signals to note explicitly: no EPSS, no KEV, and no confirmed fixed version in the supplied data.

A low-privilege authenticated ZenTao PMS user (or an attacker who has obtained any valid account) calls the doc::ajaxGetDoc() endpoint and iterates over sequential document IDs. Because the endpoint omits the checkPrivDoc() access check, the server returns body and draft content of private documents and otherwise-restricted library, product, project, or team documents. A public technical write-up describing the IDOR exists, though the input does not confirm it as working weaponized exploit code.