The vulnerability resides in the action::editComment handler of ZenTao Project Management System before release 22.6. The code fails to enforce user authorization when an authenticated user supplies an arbitrary actionID, allowing the attacker to read or overwrite comments attached to bugs, stories, tasks, and documents belonging to other users or projects they normally cannot access. The flaw is a classic authorization bypass (CWE-639) that compromises confidentiality by exposing comment content and attachments and integrity by permitting unauthorized modifications.

ZenTao PMS from easysoft, specifically all releases up to and including version 22.6. It is inferred that versions released after 22.6 include a patch that restores proper authorization checks for the editComment action.

The CVSS v3 score is 5.3, indicating medium severity. The EPSS score is < 1%, implying a very low exploitation probability, and the issue is not listed in the CISA KEV catalog. Exploitation requires a valid user account and can be achieved by iterating sequential numeric actionIDs, meaning authenticated users or compromised credentials are necessary. The risk to organizations with many users or permissive access controls is that unauthorised comments can be tampered with, potentially leading to misinformation or disclosure of sensitive project data.