CVE-2026-125747

EUVD-2026-121229
ZenTao PMS through 22.7 contains a missing object-level authorization vulnerability in module/build/control.php that allows authenticated users to modify builds in projects they do not belong to. Attackers holding build privileges in any project can supply sequential buildID values to delete, edit, or relink stories and bugs on builds in foreign or private projects.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.4 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/easysoft/zentaopms/blob/zentaopms_22.7_20261103/module/build/control.php#L100-L105
https://github.com/easysoft/zentaopms/blob/zentaopms_22.7_20261103/module/build/control.php#L211-L214
https://github.com/easysoft/zentaopms/issues/221
https://hackmd.io/@hieund/zentaopms-build-missing-object-authorization-idor
https://www.vulncheck.com/advisories/zentao-pms-through-22.7-idor-via-build-module-mutation-methods