CVE-2026-114391

EUVD-2026-107238
ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like task.ajaxGetByID, system.ajaxDBAuthUrl and admin.ajaxChangeTableEngine to read data, obtain database credentials, trigger CI jobs and alter tables.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.1 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/easysoft/zentaopms/blob/zentaopms_22.2_20260527/module/common/model.php#L446-L463
https://github.com/easysoft/zentaopms/blob/zentaopms_22.2_20260527/module/system/control.php#L454-L474
https://github.com/easysoft/zentaopms/commit/ac484f3b01c0f84002391a344d99dd2993692f49
https://github.com/easysoft/zentaopms/issues/181
https://github.com/easysoft/zentaopms/releases/tag/zentaopms_22.3_20260707
https://www.vulncheck.com/advisories/zentao-pms-before-22.3-authorization-bypass-via-ajax-controller-methods