Logo
Retour à la veille

CVE-2026-111346

Publié : 15 octobre 2026
Modifié : 15 octobre 2026
Lien officiel NVD
Score CVSS
5.4
MEDIUM

Description détaillée

ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users' comments by supplying an arbitrary actionID. Attackers can iterate sequential action ids to modify comments on bugs, stories, tasks, and documents in products and projects they cannot access, and view targeted comment content and attachments.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Références et Patchs

https://github.com/easysoft/zentaopmshttps://github.com/easysoft/zentaopms/blob/zentaopms_22.6_20260917/module/action/control.php#L384-L426https://github.com/easysoft/zentaopms/blob/zentaopms_22.6_20260917/module/action/model.php#L2025-L2057https://hackmd.io/@hieuPenguinnn/zentaopms-action-editcomment-cross-user-idorhttps://www.vulncheck.com/advisories/zentao-pms-through-22.6-authorization-bypass-via-action-editcomment

Dernières Vulnérabilités

CVE-2026-111389

Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extract sensitive information from the database.

VOIR DÉTAILS

CVE-2026-111388

Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrict_ip allowlist for non-session authentication methods, including API key, OAuth, and header-based authentication. Attackers holding valid credentials of these types can authenticate from IP addresses outside the allowlist, defeating the configured network-based access restrictions.

VOIR DÉTAILS

CVE-2026-111387

Nezha from 2.2.5 before 2.3.15 contains an information disclosure vulnerability that allows authenticated users to retrieve third-party credentials because listDDNS omits WebhookURL and WebhookRequestBody redaction. Admins or PATs with nezha:ddns:read scope can call GET /api/v1/ddns to read cleartext tokens embedded in every user's DDNS webhook profiles.

VOIR DÉTAILS