The vulnerability stems from a missing checkPrivDoc() authorization in doc::ajaxGetDoc(), allowing authenticated users to retrieve private document content. An attacker with low privileges can sequentially enumerate document identifiers and obtain both body and draft data of confidential materials, as well as restricted library, product, project, and team documents. This leads to a confidentiality breach and potential exposure of sensitive business information.

ZenTao Project Management System (PMS) versions up to and including 22.6, from the easysoft vendor, are affected. The flaw resides in the module/doc/control.php script, where the ajaxGetDoc endpoint is exposed without proper privilege checks.

The CVSS score of 7.1 denotes a moderate to high severity. No EPSS data is available, and the vulnerability is not cataloged in CISA's KEV list, suggesting current exploitation activity may be limited, but the missing authorization can be leveraged by any authenticated user via simple HTTP requests to the ajaxGetDoc endpoint, making it relatively easy to exploit.