HIGH 7.1 NVD
CVE-2026-114391
ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for a
ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like task.ajaxGetByID, system.ajaxDBAuthUrl and admin.ajaxChangeTableEngine to read data, obtain database credentials, trigger CI jobs and alter tables.
References
- https://github.com/easysoft/zentaopms/blob/zentaopms_22.2_20260527/module/common/model.php
- https://github.com/easysoft/zentaopms/blob/zentaopms_22.2_20260527/module/system/control.p
- https://github.com/easysoft/zentaopms/commit/ac484f3b01c0f84002391a344d99dd2993692f49
- https://github.com/easysoft/zentaopms/issues/181
- https://github.com/easysoft/zentaopms/releases/tag/zentaopms_22.3_20260707
This high severity vulnerability with a CVSS score of 7.1 was published on 2026-10-21 via NVD.
vulnfeed aggregates 18720 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.