{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-111346", "tracking": { "current_release_date": "2026-11-13T02:42:08.680399Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-111346", "initial_release_date": "2026-10-16T00:41:52.533262Z", "revision_history": [ { "date": "2026-10-16T00:41:52.533262Z", "number": "1", "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (5).| CWES updated (1)." }, { "date": "2026-10-16T00:41:54.774067Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-10-19T18:14:05.407401Z", "number": "3", "summary": "CVSS created.| CWES created (1).| Products created (126).| References created (6).| Description created for source.| Unknown change." }, { "date": "2026-10-19T18:14:05.498342Z", "number": "4", "summary": "Products removed (1)." }, { "date": "2026-10-19T18:14:07.058639Z", "number": "5", "summary": "NCSC Score updated." }, { "date": "2026-10-20T07:30:59.234315Z", "number": "6", "summary": "EPSS created.| Unknown change." }, { "date": "2026-10-20T07:38:50.324426Z", "number": "7", "summary": "NCSC Score updated." }, { "date": "2026-10-20T13:41:29.431167Z", "number": "8", "summary": "Products created (1)." }, { "date": "2026-10-20T18:30:12.128303Z", "number": "9", "summary": "CVSS created.| CWES created (1).| Products created (1).| References created (5).| Description created for source.| Unknown change." }, { "date": "2026-10-20T18:30:12.160085Z", "number": "10", "summary": "Unknown change." }, { "date": "2026-10-20T18:30:16.359755Z", "number": "11", "summary": "NCSC Score updated." }, { "date": "2026-11-12T14:14:15.251532Z", "number": "12", "summary": "Source connected.| CVE status created. (valid)" }, { "date": "2026-11-12T15:29:39.402526Z", "number": "13", "summary": "NCSC Score updated." }, { "date": "2026-11-13T02:41:41.011221Z", "number": "14", "summary": "Source connected.| CVE status created. (valid)" } ], "status": "interim", "version": "14" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/<=22.6", "product": { "name": "vers:unknown/<=22.6", "product_id": "CSAFPID-9754841" } }, { "category": "product_version_range", "name": "vers:unknown/zentao_11.2_build1_20190128", "product": { "name": "vers:unknown/zentao_11.2_build1_20190128", "product_id": "CSAFPID-3937031" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_10.1_20180716", "product": { "name": "vers:unknown/zentaopms_10.1_20180716", "product_id": "CSAFPID-3937035" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_10.3.1_20180907", "product": { "name": "vers:unknown/zentaopms_10.3.1_20180907", "product_id": "CSAFPID-3937037" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_10.3_20170809", "product": { "name": "vers:unknown/zentaopms_10.3_20170809", "product_id": "CSAFPID-3937038" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_10.4.stable_20180928", "product": { "name": "vers:unknown/zentaopms_10.4.stable_20180928", "product_id": "CSAFPID-3937039" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_10.5.1_20181105", "product": { "name": "vers:unknown/zentaopms_10.5.1_20181105", "product_id": "CSAFPID-3937040" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_10.6.stable_20181120", "product": { "name": "vers:unknown/zentaopms_10.6.stable_20181120", "product_id": "CSAFPID-3937042" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_11.0.stable_20181221", "product": { "name": "vers:unknown/zentaopms_11.0.stable_20181221", "product_id": "CSAFPID-3937043" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_11.1.stable_20190104", "product": { "name": "vers:unknown/zentaopms_11.1.stable_20190104", "product_id": "CSAFPID-3937044" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_11.4.stable_20190325", "product": { "name": "vers:unknown/zentaopms_11.4.stable_20190325", "product_id": "CSAFPID-3937049" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_11.5.stable_20190508", "product": { "name": "vers:unknown/zentaopms_11.5.stable_20190508", "product_id": "CSAFPID-3937054" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_11.6.0.beta1_20190705", "product": { "name": "vers:unknown/zentaopms_11.6.0.beta1_20190705", "product_id": "CSAFPID-3937055" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_11.6.1_20190823", "product": { "name": "vers:unknown/zentaopms_11.6.1_20190823", "product_id": "CSAFPID-3937056" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_11.6.2_20190906", "product": { "name": "vers:unknown/zentaopms_11.6.2_20190906", "product_id": "CSAFPID-3937057" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_11.6.3_20190924", "product": { "name": "vers:unknown/zentaopms_11.6.3_20190924", "product_id": "CSAFPID-3937058" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_11.6.4_20191017", "product": { "name": "vers:unknown/zentaopms_11.6.4_20191017", "product_id": "CSAFPID-3937059" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_11.7.stable_20191129", "product": { "name": "vers:unknown/zentaopms_11.7.stable_20191129", "product_id": "CSAFPID-3937065" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_12.0.stable_20200103", "product": { "name": "vers:unknown/zentaopms_12.0.stable_20200103", "product_id": "CSAFPID-3937067" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_12.3.2_20200601", "product": { "name": "vers:unknown/zentaopms_12.3.2_20200601", "product_id": "CSAFPID-3937071" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_12.3.3_20200707", "product": { "name": "vers:unknown/zentaopms_12.3.3_20200707", "product_id": "CSAFPID-3937073" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_13.0._20201022", "product": { "name": "vers:unknown/zentaopms_13.0._20201022", "product_id": "CSAFPID-3937083" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_13.0.alpha1_20201103", "product": { "name": "vers:unknown/zentaopms_13.0.alpha1_20201103", "product_id": "CSAFPID-3937084" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_13.0.alpha2_20201123", "product": { "name": "vers:unknown/zentaopms_13.0.alpha2_20201123", "product_id": "CSAFPID-3937085" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_13.0.beta1_20201201", "product": { "name": "vers:unknown/zentaopms_13.0.beta1_20201201", "product_id": "CSAFPID-3937086" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_13.0.beta4_20210202", "product": { "name": "vers:unknown/zentaopms_13.0.beta4_20210202", "product_id": "CSAFPID-3937088" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_13.beta2_20201218", "product": { "name": "vers:unknown/zentaopms_13.beta2_20201218", "product_id": "CSAFPID-3937090" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_15.0.1_20210606", "product": { "name": "vers:unknown/zentaopms_15.0.1_20210606", "product_id": "CSAFPID-3937091" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_15.2_20210720", "product": { "name": "vers:unknown/zentaopms_15.2_20210720", "product_id": "CSAFPID-3937108" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_15.3_20210804", "product": { "name": "vers:unknown/zentaopms_15.3_20210804", "product_id": "CSAFPID-3937110" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_15.4_20210823", "product": { "name": "vers:unknown/zentaopms_15.4_20210823", "product_id": "CSAFPID-3937112" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_15.5_20210914", "product": { "name": "vers:unknown/zentaopms_15.5_20210914", "product_id": "CSAFPID-3937113" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_15.7.1_20211102", "product": { "name": "vers:unknown/zentaopms_15.7.1_20211102", "product_id": "CSAFPID-3937115" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_15.8_20211122", "product": { "name": "vers:unknown/zentaopms_15.8_20211122", "product_id": "CSAFPID-3937118" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_16.0", "product": { "name": "vers:unknown/zentaopms_16.0", "product_id": "CSAFPID-3937119" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_16.0.beta1", "product": { "name": "vers:unknown/zentaopms_16.0.beta1", "product_id": "CSAFPID-3937121" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_16.0.beta1_20211207", "product": { "name": "vers:unknown/zentaopms_16.0.beta1_20211207", "product_id": "CSAFPID-3937122" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_16.2", "product": { "name": "vers:unknown/zentaopms_16.2", "product_id": "CSAFPID-3937124" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_16.3", "product": { "name": "vers:unknown/zentaopms_16.3", "product_id": "CSAFPID-3937125" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_16.4", "product": { "name": "vers:unknown/zentaopms_16.4", "product_id": "CSAFPID-3937126" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_16.5.beta1", "product": { "name": "vers:unknown/zentaopms_16.5.beta1", "product_id": "CSAFPID-3937128" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_17.0", "product": { "name": "vers:unknown/zentaopms_17.0", "product_id": "CSAFPID-3937129" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_17.1", "product": { "name": "vers:unknown/zentaopms_17.1", "product_id": "CSAFPID-3937132" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_17.6", "product": { "name": "vers:unknown/zentaopms_17.6", "product_id": "CSAFPID-3937137" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_17.6.2", "product": { "name": "vers:unknown/zentaopms_17.6.2", "product_id": "CSAFPID-3937139" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_17.7", "product": { "name": "vers:unknown/zentaopms_17.7", "product_id": "CSAFPID-3937140" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_17.8", "product": { "name": "vers:unknown/zentaopms_17.8", "product_id": "CSAFPID-3937141" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_18.0.beta1", "product": { "name": "vers:unknown/zentaopms_18.0.beta1", "product_id": "CSAFPID-3937143" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_18.0.beta2", "product": { "name": "vers:unknown/zentaopms_18.0.beta2", "product_id": "CSAFPID-3937144" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_18.1", "product": { "name": "vers:unknown/zentaopms_18.1", "product_id": "CSAFPID-3937146" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_18.3", "product": { "name": "vers:unknown/zentaopms_18.3", "product_id": "CSAFPID-3937149" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_20.0._20201022", "product": { "name": "vers:unknown/zentaopms_20.0._20201022", "product_id": "CSAFPID-3937157" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_20.0.alpha1_20201103", "product": { "name": "vers:unknown/zentaopms_20.0.alpha1_20201103", "product_id": "CSAFPID-3937159" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_20.0.alpha2_20201123", "product": { "name": "vers:unknown/zentaopms_20.0.alpha2_20201123", "product_id": "CSAFPID-3937160" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_20.0.alpha_20201030_1", "product": { "name": "vers:unknown/zentaopms_20.0.alpha_20201030_1", "product_id": "CSAFPID-3937161" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_20.0.beta1", "product": { "name": "vers:unknown/zentaopms_20.0.beta1", "product_id": "CSAFPID-5662645" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_20.0.beta1_20201201", "product": { "name": "vers:unknown/zentaopms_20.0.beta1_20201201", "product_id": "CSAFPID-3937162" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_20.0.beta4_20210202", "product": { "name": "vers:unknown/zentaopms_20.0.beta4_20210202", "product_id": "CSAFPID-3937164" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_20.1.1_20240614", "product": { "name": "vers:unknown/zentaopms_20.1.1_20240614", "product_id": "CSAFPID-5662647" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_20.2.0_20240710", "product": { "name": "vers:unknown/zentaopms_20.2.0_20240710", "product_id": "CSAFPID-5662648" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_20.3.0_20240722", "product": { "name": "vers:unknown/zentaopms_20.3.0_20240722", "product_id": "CSAFPID-5662649" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_20.4_20240802", "product": { "name": "vers:unknown/zentaopms_20.4_20240802", "product_id": "CSAFPID-5662650" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_20.4_20240803", "product": { "name": "vers:unknown/zentaopms_20.4_20240803", "product_id": "CSAFPID-5662651" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_20.4_20240805", "product": { "name": "vers:unknown/zentaopms_20.4_20240805", "product_id": "CSAFPID-5662652" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_20.5_20240816", "product": { "name": "vers:unknown/zentaopms_20.5_20240816", "product_id": "CSAFPID-5662653" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_20.5_20240819", "product": { "name": "vers:unknown/zentaopms_20.5_20240819", "product_id": "CSAFPID-5662654" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_20.6_20240830", "product": { "name": "vers:unknown/zentaopms_20.6_20240830", "product_id": "CSAFPID-5662655" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_20.6_20240902", "product": { "name": "vers:unknown/zentaopms_20.6_20240902", "product_id": "CSAFPID-5662656" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_20.7.1_20240930", "product": { "name": "vers:unknown/zentaopms_20.7.1_20240930", "product_id": "CSAFPID-5662657" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_20.7_20240914", "product": { "name": "vers:unknown/zentaopms_20.7_20240914", "product_id": "CSAFPID-5662658" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_20.8_20241022", "product": { "name": "vers:unknown/zentaopms_20.8_20241022", "product_id": "CSAFPID-5662659" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_20.beta2_20201218", "product": { "name": "vers:unknown/zentaopms_20.beta2_20201218", "product_id": "CSAFPID-3937166" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_21.0_20241104", "product": { "name": "vers:unknown/zentaopms_21.0_20241104", "product_id": "CSAFPID-5662660" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_21.0_20241106", "product": { "name": "vers:unknown/zentaopms_21.0_20241106", "product_id": "CSAFPID-5662661" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_21.2_20241205", "product": { "name": "vers:unknown/zentaopms_21.2_20241205", "product_id": "CSAFPID-5662662" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_21.3_20241227", "product": { "name": "vers:unknown/zentaopms_21.3_20241227", "product_id": "CSAFPID-5662663" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_21.4_20250115", "product": { "name": "vers:unknown/zentaopms_21.4_20250115", "product_id": "CSAFPID-5662664" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_21.5_20250306", "product": { "name": "vers:unknown/zentaopms_21.5_20250306", "product_id": "CSAFPID-5662665" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_21.5_20250307", "product": { "name": "vers:unknown/zentaopms_21.5_20250307", "product_id": "CSAFPID-5662666" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_21.6.beta_20250321", "product": { "name": "vers:unknown/zentaopms_21.6.beta_20250321", "product_id": "CSAFPID-5662667" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_21.6_20250411", "product": { "name": "vers:unknown/zentaopms_21.6_20250411", "product_id": "CSAFPID-5662668" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_21.6_20250414", "product": { "name": "vers:unknown/zentaopms_21.6_20250414", "product_id": "CSAFPID-5662669" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_22.2_20260527", "product": { "name": "vers:unknown/zentaopms_22.2_20260527", "product_id": "CSAFPID-9734995" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_22.3_20260707", "product": { "name": "vers:unknown/zentaopms_22.3_20260707", "product_id": "CSAFPID-9734996" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_22.6_20260917", "product": { "name": "vers:unknown/zentaopms_22.6_20260917", "product_id": "CSAFPID-9734997" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_4.3.beta_20130805", "product": { "name": "vers:unknown/zentaopms_4.3.beta_20130805", "product_id": "CSAFPID-3937167" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_5.0.beta1_20130809", "product": { "name": "vers:unknown/zentaopms_5.0.beta1_20130809", "product_id": "CSAFPID-3937168" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_6.0.beta1_20140503", "product": { "name": "vers:unknown/zentaopms_6.0.beta1_20140503", "product_id": "CSAFPID-3937175" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_6.0.stable_20140625", "product": { "name": "vers:unknown/zentaopms_6.0.stable_20140625", "product_id": "CSAFPID-3937176" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_6.1.stable_20140805", "product": { "name": "vers:unknown/zentaopms_6.1.stable_20140805", "product_id": "CSAFPID-3937177" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_6.1.stable_20140806", "product": { "name": "vers:unknown/zentaopms_6.1.stable_20140806", "product_id": "CSAFPID-3937178" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_6.2.stable_20140827", "product": { "name": "vers:unknown/zentaopms_6.2.stable_20140827", "product_id": "CSAFPID-3937179" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_6.3.stable_20141107", "product": { "name": "vers:unknown/zentaopms_6.3.stable_20141107", "product_id": "CSAFPID-3937180" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_6.4.stable_20141223", "product": { "name": "vers:unknown/zentaopms_6.4.stable_20141223", "product_id": "CSAFPID-3937181" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_7.0.stable_20150206", "product": { "name": "vers:unknown/zentaopms_7.0.stable_20150206", "product_id": "CSAFPID-3937182" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_7.1.stable_20150317", "product": { "name": "vers:unknown/zentaopms_7.1.stable_20150317", "product_id": "CSAFPID-3937183" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_7.2.4_20150703", "product": { "name": "vers:unknown/zentaopms_7.2.4_20150703", "product_id": "CSAFPID-3937184" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_7.2.5_20150807", "product": { "name": "vers:unknown/zentaopms_7.2.5_20150807", "product_id": "CSAFPID-3937185" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_7.2.stable_20150525", "product": { "name": "vers:unknown/zentaopms_7.2.stable_20150525", "product_id": "CSAFPID-3937186" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_7.3.stable_20150918", "product": { "name": "vers:unknown/zentaopms_7.3.stable_20150918", "product_id": "CSAFPID-3937187" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_8.0.1_20151224", "product": { "name": "vers:unknown/zentaopms_8.0.1_20151224", "product_id": "CSAFPID-3937189" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_8.0.stable_20151127", "product": { "name": "vers:unknown/zentaopms_8.0.stable_20151127", "product_id": "CSAFPID-3937190" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_8.1.3_20160323", "product": { "name": "vers:unknown/zentaopms_8.1.3_20160323", "product_id": "CSAFPID-3937191" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_8.1.stable_20160315", "product": { "name": "vers:unknown/zentaopms_8.1.stable_20160315", "product_id": "CSAFPID-3937192" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_8.2.1_20160524", "product": { "name": "vers:unknown/zentaopms_8.2.1_20160524", "product_id": "CSAFPID-3937193" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_8.2.2_20160608", "product": { "name": "vers:unknown/zentaopms_8.2.2_20160608", "product_id": "CSAFPID-3937194" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_8.2.3_20160624", "product": { "name": "vers:unknown/zentaopms_8.2.3_20160624", "product_id": "CSAFPID-3937195" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_8.2.4_20160628", "product": { "name": "vers:unknown/zentaopms_8.2.4_20160628", "product_id": "CSAFPID-3937196" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_8.2.5_20160805", "product": { "name": "vers:unknown/zentaopms_8.2.5_20160805", "product_id": "CSAFPID-3937197" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_8.2.6_20160913", "product": { "name": "vers:unknown/zentaopms_8.2.6_20160913", "product_id": "CSAFPID-3937198" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_8.2.beta_20160504", "product": { "name": "vers:unknown/zentaopms_8.2.beta_20160504", "product_id": "CSAFPID-3937199" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_8.2.stable_20160517", "product": { "name": "vers:unknown/zentaopms_8.2.stable_20160517", "product_id": "CSAFPID-3937200" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_8.3.4_20160628", "product": { "name": "vers:unknown/zentaopms_8.3.4_20160628", "product_id": "CSAFPID-3937201" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_8.3.stable_20161109", "product": { "name": "vers:unknown/zentaopms_8.3.stable_20161109", "product_id": "CSAFPID-3937202" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_8.4.1_20161212", "product": { "name": "vers:unknown/zentaopms_8.4.1_20161212", "product_id": "CSAFPID-3937203" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_8.4.stable_20161206", "product": { "name": "vers:unknown/zentaopms_8.4.stable_20161206", "product_id": "CSAFPID-3937204" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_9.0.1_20170215", "product": { "name": "vers:unknown/zentaopms_9.0.1_20170215", "product_id": "CSAFPID-3937205" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_9.0.stable_20170117", "product": { "name": "vers:unknown/zentaopms_9.0.stable_20170117", "product_id": "CSAFPID-3937207" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_9.1.1_20170410", "product": { "name": "vers:unknown/zentaopms_9.1.1_20170410", "product_id": "CSAFPID-3937208" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_9.1.2_20170419", "product": { "name": "vers:unknown/zentaopms_9.1.2_20170419", "product_id": "CSAFPID-3937209" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_9.2.1_20170522", "product": { "name": "vers:unknown/zentaopms_9.2.1_20170522", "product_id": "CSAFPID-3937211" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_9.2.stable_20170516", "product": { "name": "vers:unknown/zentaopms_9.2.stable_20170516", "product_id": "CSAFPID-3937212" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_9.3.beta_20170627", "product": { "name": "vers:unknown/zentaopms_9.3.beta_20170627", "product_id": "CSAFPID-3937213" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_9.4_20170726", "product": { "name": "vers:unknown/zentaopms_9.4_20170726", "product_id": "CSAFPID-3937214" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_9.5.1_20170927", "product": { "name": "vers:unknown/zentaopms_9.5.1_20170927", "product_id": "CSAFPID-3937215" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_9.6.1_20171113", "product": { "name": "vers:unknown/zentaopms_9.6.1_20171113", "product_id": "CSAFPID-3937217" } }, { "category": "product_version_range", "name": "vers:unknown/zentaopms_9.6_20171106", "product": { "name": "vers:unknown/zentaopms_9.6_20171106", "product_id": "CSAFPID-3937219" } } ], "category": "product_name", "name": "zentaopms" } ], "category": "vendor", "name": "easysoft" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-111346", "cwe": { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key" }, "notes": [ { "category": "description", "text": "ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users' comments by supplying an arbitrary actionID. Attackers can iterate sequential action ids to modify comments on bugs, stories, tasks, and documents in products and projects they cannot access, and view targeted comment content and attachments.", "title": "nvd - https://nvd.nist.gov/vuln/detail/CVE-2026-111346" }, { "category": "description", "text": "ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users' comments by supplying an arbitrary actionID. Attackers can iterate sequential action ids to modify comments on bugs, stories, tasks, and documents in products and projects they cannot access, and view targeted comment content and attachments.", "title": "osvgit - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-111346.json?alt=media" }, { "category": "description", "text": "ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users' comments by supplying an arbitrary actionID. Attackers can iterate sequential action ids to modify comments on bugs, stories, tasks, and documents in products and projects they cannot access, and view targeted comment content and attachments.", "title": "cveprojectv5 - https://www.cve.org/CVERecord?id=CVE-2026-111346" }, { "category": "other", "text": "0.00239", "title": "EPSS" }, { "category": "other", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "title": "CVSSV4" }, { "category": "other", "text": "5.3", "title": "CVSSV4 base score" }, { "category": "other", "text": "3.9", "title": "NCSC Score" }, { "category": "other", "text": "The value of the most recent CVSS (V3) score, There is cwe data available from source Nvd", "title": "NCSC Score top decreasing factors" } ], "product_status": { "known_affected": [ "CSAFPID-3937031", "CSAFPID-3937035", "CSAFPID-3937037", "CSAFPID-3937038", "CSAFPID-3937039", "CSAFPID-3937040", "CSAFPID-3937042", "CSAFPID-3937043", "CSAFPID-3937044", "CSAFPID-3937049", "CSAFPID-3937054", "CSAFPID-3937055", "CSAFPID-3937056", "CSAFPID-3937057", "CSAFPID-3937058", "CSAFPID-3937059", "CSAFPID-3937065", "CSAFPID-3937067", "CSAFPID-3937071", "CSAFPID-3937073", "CSAFPID-3937083", "CSAFPID-3937084", "CSAFPID-3937085", "CSAFPID-3937086", "CSAFPID-3937088", "CSAFPID-3937090", "CSAFPID-3937091", "CSAFPID-3937108", "CSAFPID-3937110", "CSAFPID-3937112", "CSAFPID-3937113", "CSAFPID-3937115", "CSAFPID-3937118", "CSAFPID-3937119", "CSAFPID-3937121", "CSAFPID-3937122", "CSAFPID-3937124", "CSAFPID-3937125", "CSAFPID-3937126", "CSAFPID-3937128", "CSAFPID-3937129", "CSAFPID-3937132", "CSAFPID-3937137", "CSAFPID-3937139", "CSAFPID-3937140", "CSAFPID-3937141", "CSAFPID-3937143", "CSAFPID-3937144", "CSAFPID-3937146", "CSAFPID-3937149", "CSAFPID-3937157", "CSAFPID-3937159", "CSAFPID-3937160", "CSAFPID-3937161", "CSAFPID-5662645", "CSAFPID-3937162", "CSAFPID-3937164", "CSAFPID-5662647", "CSAFPID-5662648", "CSAFPID-5662649", "CSAFPID-5662650", "CSAFPID-5662651", "CSAFPID-5662652", "CSAFPID-5662653", "CSAFPID-5662654", "CSAFPID-5662655", "CSAFPID-5662656", "CSAFPID-5662657", "CSAFPID-5662658", "CSAFPID-5662659", "CSAFPID-3937166", "CSAFPID-5662660", "CSAFPID-5662661", "CSAFPID-5662662", "CSAFPID-5662663", "CSAFPID-5662664", "CSAFPID-5662665", "CSAFPID-5662666", "CSAFPID-5662667", "CSAFPID-5662668", "CSAFPID-5662669", "CSAFPID-9734995", "CSAFPID-9734996", "CSAFPID-9734997", "CSAFPID-3937167", "CSAFPID-3937168", "CSAFPID-3937175", "CSAFPID-3937176", "CSAFPID-3937177", "CSAFPID-3937178", "CSAFPID-3937179", "CSAFPID-3937180", "CSAFPID-3937181", "CSAFPID-3937182", "CSAFPID-3937183", "CSAFPID-3937184", "CSAFPID-3937185", "CSAFPID-3937186", "CSAFPID-3937187", "CSAFPID-3937189", "CSAFPID-3937190", "CSAFPID-3937191", "CSAFPID-3937192", "CSAFPID-3937193", "CSAFPID-3937194", "CSAFPID-3937195", "CSAFPID-3937196", "CSAFPID-3937197", "CSAFPID-3937198", "CSAFPID-3937199", "CSAFPID-3937200", "CSAFPID-3937201", "CSAFPID-3937202", "CSAFPID-3937203", "CSAFPID-3937204", "CSAFPID-3937205", "CSAFPID-3937207", "CSAFPID-3937208", "CSAFPID-3937209", "CSAFPID-3937211", "CSAFPID-3937212", "CSAFPID-3937213", "CSAFPID-3937214", "CSAFPID-3937215", "CSAFPID-3937217", "CSAFPID-3937219", "CSAFPID-9754841" ] }, "references": [ { "category": "external", "summary": "Source - hkcert", "url": "https://www.hkcert.org/security-bulletin/citrix-products-multiple-vulnerabilities_20261113" }, { "category": "external", "summary": "Source - ncscclear", "url": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0491" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111346" }, { "category": "external", "summary": "Source - ncscclear", "url": "https://vulnerabilities.ncsc.nl/manual/CVE-2026-111346" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-111346.json?alt=media" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss" }, { "category": "external", "summary": "Source - cveprojectv5", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111346" }, { "category": "external", "summary": "Reference - cveprojectv5; nvd", "url": "https://github.com/easysoft/zentaopms" }, { "category": "external", "summary": "Reference - cveprojectv5; nvd; osv", "url": "https://github.com/easysoft/zentaopms/blob/zentaopms_22.6_20260917/module/action/control.php#L384-L426" }, { "category": "external", "summary": "Reference - cveprojectv5; nvd; osv", "url": "https://github.com/easysoft/zentaopms/blob/zentaopms_22.6_20260917/module/action/model.php#L2025-L2057" }, { "category": "external", "summary": "Reference - cveprojectv5; nvd; osv", "url": "https://hackmd.io/@hieuPenguinnn/zentaopms-action-editcomment-cross-user-idor" }, { "category": "external", "summary": "Reference - cveprojectv5; nvd; osv", "url": "https://www.vulncheck.com/advisories/zentao-pms-through-22.6-authorization-bypass-via-action-editcomment" }, { "category": "external", "summary": "Reference - osv", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111346.json" }, { "category": "external", "summary": "Reference - osv", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111346" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-3937031", "CSAFPID-3937035", "CSAFPID-3937037", "CSAFPID-3937038", "CSAFPID-3937039", "CSAFPID-3937040", "CSAFPID-3937042", "CSAFPID-3937043", "CSAFPID-3937044", "CSAFPID-3937049", "CSAFPID-3937054", "CSAFPID-3937055", "CSAFPID-3937056", "CSAFPID-3937057", "CSAFPID-3937058", "CSAFPID-3937059", "CSAFPID-3937065", "CSAFPID-3937067", "CSAFPID-3937071", "CSAFPID-3937073", "CSAFPID-3937083", "CSAFPID-3937084", "CSAFPID-3937085", "CSAFPID-3937086", "CSAFPID-3937088", "CSAFPID-3937090", "CSAFPID-3937091", "CSAFPID-3937108", "CSAFPID-3937110", "CSAFPID-3937112", "CSAFPID-3937113", "CSAFPID-3937115", "CSAFPID-3937118", "CSAFPID-3937119", "CSAFPID-3937121", "CSAFPID-3937122", "CSAFPID-3937124", "CSAFPID-3937125", "CSAFPID-3937126", "CSAFPID-3937128", "CSAFPID-3937129", "CSAFPID-3937132", "CSAFPID-3937137", "CSAFPID-3937139", "CSAFPID-3937140", "CSAFPID-3937141", "CSAFPID-3937143", "CSAFPID-3937144", "CSAFPID-3937146", "CSAFPID-3937149", "CSAFPID-3937157", "CSAFPID-3937159", "CSAFPID-3937160", "CSAFPID-3937161", "CSAFPID-3937162", "CSAFPID-3937164", "CSAFPID-3937166", "CSAFPID-3937167", "CSAFPID-3937168", "CSAFPID-3937175", "CSAFPID-3937176", "CSAFPID-3937177", "CSAFPID-3937178", "CSAFPID-3937179", "CSAFPID-3937180", "CSAFPID-3937181", "CSAFPID-3937182", "CSAFPID-3937183", "CSAFPID-3937184", "CSAFPID-3937185", "CSAFPID-3937186", "CSAFPID-3937187", "CSAFPID-3937189", "CSAFPID-3937190", "CSAFPID-3937191", "CSAFPID-3937192", "CSAFPID-3937193", "CSAFPID-3937194", "CSAFPID-3937195", "CSAFPID-3937196", "CSAFPID-3937197", "CSAFPID-3937198", "CSAFPID-3937199", "CSAFPID-3937200", "CSAFPID-3937201", "CSAFPID-3937202", "CSAFPID-3937203", "CSAFPID-3937204", "CSAFPID-3937205", "CSAFPID-3937207", "CSAFPID-3937208", "CSAFPID-3937209", "CSAFPID-3937211", "CSAFPID-3937212", "CSAFPID-3937213", "CSAFPID-3937214", "CSAFPID-3937215", "CSAFPID-3937217", "CSAFPID-3937219", "CSAFPID-5662645", "CSAFPID-5662647", "CSAFPID-5662648", "CSAFPID-5662649", "CSAFPID-5662650", "CSAFPID-5662651", "CSAFPID-5662652", "CSAFPID-5662653", "CSAFPID-5662654", "CSAFPID-5662655", "CSAFPID-5662656", "CSAFPID-5662657", "CSAFPID-5662658", "CSAFPID-5662659", "CSAFPID-5662660", "CSAFPID-5662661", "CSAFPID-5662662", "CSAFPID-5662663", "CSAFPID-5662664", "CSAFPID-5662665", "CSAFPID-5662666", "CSAFPID-5662667", "CSAFPID-5662668", "CSAFPID-5662669", "CSAFPID-9734995", "CSAFPID-9734996", "CSAFPID-9734997", "CSAFPID-9754841" ] } ], "title": "CVE-2026-111346" } ] }