CVE-2026-114391
HIGH
CVSS 7.1
Published: 2026-10-21
Modified: 2026-10-22
Tenable Plugin
Checking the public Tenable catalog…
Threat Intelligence Pending
IOCs, MITRE ATT&CK techniques, and attack chain data are being generated. Refresh in a few seconds.
Description
ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like task.ajaxGetByID, system.ajaxDBAuthUrl and admin.ajaxChangeTableEngine to read data, obtain database credentials, trigger CI jobs and alter tables.
Quick Facts
| CVE ID | CVE-2026-114391 |
| CVSS Score | 7.1 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N |
| Published | 2026-10-21 |
| Exploited | No |
| CISA KEV | No |
| PoC | Not public |
References
- https://github.com/easysoft/zentaopms/blob/zentaopms_22.2_20…
- https://github.com/easysoft/zentaopms/blob/zentaopms_22.2_20…
- https://github.com/easysoft/zentaopms/commit/ac484f3b01c0f84…
- https://github.com/easysoft/zentaopms/issues/181
- https://github.com/easysoft/zentaopms/releases/tag/zentaopms…
- https://www.vulncheck.com/advisories/zentao-pms-before-22.3-…