ZenTao PMS EUVD-2026-102490

Requires a valid authenticated ZenTao PMS session at any low privilege level (PR:L) - the action::editComment handler accepts an attacker-supplied actionID without verifying that the requesting user has authorization over the target comment's underlying object, so no special feature toggle or non-default configuration is needed. Exploitation works against default configurations of ZenTao PMS through 22.6. The key limiting factor is the authentication requirement: an attacker must first hold a legitimate account, so this is not a fully unauthenticated external attack; however, any authenticated user (including minimally privileged ones) can reach it, and the sequential, predictable action IDs make enumeration trivial.

This is a genuine but moderate-severity authorization (IDOR) issue, not a drop-everything emergency. The CVSS 4.0 base score of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N) is internally consistent with the description: network-reachable, trivially low complexity, but requiring an authenticated low-privileged account (PR:L) and yielding only low confidentiality and low integrity impact with no availability effect. The constrained impact reflects that an attacker can read and overwrite comment content and attachments on bugs, stories, tasks, and documents - a cross-tenant/cross-project data-integrity and disclosure problem - rather than achieving code execution or full account takeover. No EPSS score, CISA KEV listing, or SSVC decision data was provided in the input, so exploitation probability cannot be quantified from the intelligence supplied; absence of these signals is not evidence of low risk, only of missing data. A detailed public technical writeup (hackmd) and the VulnCheck advisory precisely document the vulnerable code paths (control.php editComment and model.php), which materially lowers the barrier to reproduction even though no packaged exploit is flagged in the input. The 'automatable' nature of iterating sequential action IDs means that any authenticated user can systematically harvest and tamper with comments at scale, which is the primary risk driver here and arguably more concerning than the low CVSS impact subscores suggest.

A low-privileged but authenticated ZenTao user (e.g., a contractor with access to a single product) scripts requests to action::editComment, iterating sequential actionID values to read and silently overwrite comments and attachments on bugs, stories, tasks, and documents in products and projects they were never granted access to. Because the flaw is network-reachable with low attack complexity and the action IDs are sequential and predictable, enumeration is straightforward and automatable. No packaged exploit is flagged in the input, but a detailed public technical writeup documenting the vulnerable code paths exists.