Read the docs
TI-2026-78772 Aliases CVE-2026-114391GHSA-crpg-r4ww-5jx4

ZenTao PMS Authorization Bypass via Ajax Controller Methods

Priority LOW 31CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

ZenTao PMS before 22.3 has an authorization bypass in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for any method whose name contains 'ajax'. Users with minimal privileges can call methods such as task.ajaxGetByID, system.ajaxDBAuthUrl and admin.ajaxChangeTableEngine to read data, obtain database credentials, trigger CI jobs and alter tables. CWE-863 (Incorrect Authorization) applies; the CNA scored it 7.1 HIGH under CVSS 4.0 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N). CISA SSVC rates exploitation as none and automatable as no.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like task.ajaxGetByID, system.ajaxDBAuthUrl and admin.ajaxChangeTableEngine to read data, obtain database credentials, trigger CI jobs and alter tables.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00299 22nd percentileScored 2026-11-07
Fix Fixed zentaopms (easysoft): 22.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
easysoftzentaopmsbefore 22.322.3Patch availableCNA
  • zentaopms Vendoreasysoft Affected before 22.3 Fixed in 22.3 Patch available CNA

Remediation

Upgrade ZenTao PMS to version 22.3 or later. No exploit is listed in CISA KEV.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA zentaopms (easysoft) Fixed in 22.3

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-114391
  2. 2026-10-21 Alias added: GHSA-crpg-r4ww-5jx4
  3. 2026-10-21 CISA SSVC decision points changed
  4. 2026-10-21 Priority changed: MEDIUM → LOW

References

Patch 1

Other 4

  • TI-2026-75080 ZenTao PMS Authorization Bypass via action::editComment CVSS 4.0MEDIUM 5.3
  • TI-2026-83119 Missing authorization in ZenTao PMS lets users read private documents CVSS 4.0HIGH 7.1
  • TI-2026-84800 Improper privilege management in EasySoft ZenTao PMS User module CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences