Vulnerability · Published Nov 3, 2026 · Assigned by VulDB

CVE-2026-121514EasySoft ZenTao PMS User model.php checkGroupChange privileges management

Medium 6.3

In plain English

A medium-severity privilege mismanagement in ZenTao PMS from EasySoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.2%top 89.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A weakness has been identified in EasySoft ZenTao PMS up to 22.6. This impacts the function userModel::checkGroupChange of the file module/user/model.php of the component User Module. This manipulation of the argument group causes improper privilege management. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
EasySoft	ZenTao PMS	22.022.122.222.322.422.522.6

Weakness: CWE-269, CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C

References

VDB-430286 | EasySoft ZenTao PMS User model.php checkGroupChange privileges management vdb-entry, technical-description
VDB-430286 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-121514 | CVE Analysis and Report third-party-advisory
Submit #1019652 | ZenTao ZenTao PMS 22.6 Privilege Escalation third-party-advisory