CVE-2026-125747: ZenTao PMS through 22.7 IDOR via Build Module Mutation Methods

Published Nov 10, 2026

Updated

ZenTao PMS through 22.7 contains a missing object-level authorization vulnerability in module/build/control.php that allows authenticated users to modify builds in projects they do not belong to. Attackers holding build privileges in any project can supply sequential buildID values to delete, edit, or relink stories and bugs on builds in foreign or private projects.

Event History

Nov 10, 2026

CVE Published

via MITRE·03:22 PM

Data Sourced

via MITRE·03:22 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users can exploit this issue?

An attacker must be authenticated and have build privileges in at least one ZenTao project. They do not need to belong to the project whose builds they target.

What actions can an attacker perform against builds in other projects?

By supplying sequential buildID values, an attacker can delete or edit builds and relink stories and bugs on builds in foreign or private projects.

How can teams identify potential exposure?

Review ZenTao instances through version 22.7 and examine build mutation activity for edits, deletions, or story and bug relinking involving users who were not members of the affected project. Build identifiers that appear to have been enumerated sequentially are especially relevant.

CVE-2026-125747: ZenTao PMS through 22.7 IDOR via Build Module Mutation Methods

Event History

Frequently Asked Questions

Which users can exploit this issue?

What actions can an attacker perform against builds in other projects?

How can teams identify potential exposure?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

What actions can an attacker perform against builds in other projects?

How can teams identify potential exposure?