Vulnerability · Published Oct 21, 2026 · Assigned by VulnCheck

CVE-2026-114391ZenTao PMS before 22.3 Authorization Bypass via Ajax Controller Methods

High 7.1

In plain English

A high-severity incorrect authorization in zentaopms from easysoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.3%top 77.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like task.ajaxGetByID, system.ajaxDBAuthUrl and admin.ajaxChangeTableEngine to read data, obtain database credentials, trigger CI jobs and alter tables.

Affected products (as reported)

Vendor	Product	Versions
easysoft	zentaopms	0 – before 22.3

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

References

https://github.com/easysoft/zentaopms/issues/181 issue-tracking
https://github.com/easysoft/zentaopms/commit/ac484f3b01c0f84002391a344d99dd2993692f49 patch
zentaopms zentaopms_22.3_20260707 Release Notes release-notes
https://github.com/easysoft/zentaopms/blob/zentaopms_22.2_20260527/module/common/model.php#L446-L463 technical-description
https://github.com/easysoft/zentaopms/blob/zentaopms_22.2_20260527/module/system/control.php#L454-L474 technical-description
VulnCheck Advisory: ZenTao PMS before 22.3 Authorization Bypass via Ajax Controller Methods third-party-advisory