PT-2026-120578

CVE-2026-114391

Published

2026-10-21

Updated

2026-10-21

Description by

CVSS 4.0

7.1

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ZenTao PMS versions prior to 22.3

Description An authorization bypass exists in the isOpenMethod() function of commonModel. This issue allows authenticated users to circumvent group-based Access Control List (ACL) checks for any method that includes the string 'ajax'. Consequently, users with minimal privileges can execute methods such as task.ajaxGetByID, system.ajaxDBAuthUrl, and admin.ajaxChangeTableEngine to read sensitive data, retrieve database credentials, trigger Continuous Integration (CI) jobs, and modify database tables.

Recommendations Update ZenTao PMS to version 22.3 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Leediay153

Lighthousekeeper1212

Vendors

Affected products

Weakness enumeration

CWE-863: Incorrect Authorization