Read the docs
TI-2026-84800 Aliases CVE-2026-121514GHSA-8xgp-wvrv-hg89

Improper privilege management in EasySoft ZenTao PMS User module

Priority LOW 23CWE-266Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Privilege escalation
Confidentiality · integrity · availability
Low · Low · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-266.

Summary

EasySoft ZenTao PMS up to 22.6 has improper privilege management in the userModel::checkGroupChange function of module/user/model.php in the User Module (CWE-269). Manipulating the group argument lets a remote attacker with low privileges gain privileges they should not have. The attack needs no user interaction and affects confidentiality, integrity and availability at a low level. The vendor was contacted early about this disclosure but did not respond.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

A weakness has been identified in EasySoft ZenTao PMS up to 22.6. This impacts the function userModel::checkGroupChange of the file module/user/model.php of the component User Module. This manipulation of the argument group causes improper privilege management. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00201 10th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
easysoftZenTao PMS22.0; 22.1; 22.2; 22.3; 22.4; 22.5; 22.6—No fix listedCNA
  • ZenTao PMS Vendoreasysoft Affected 22.0; 22.1; 22.2; 22.3; 22.4; 22.5; 22.6 Fixed in — No fix listed CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:easysoft:zentao_pms:*:*:*:*:*:*:*:*——easysoft
  • cpe:2.3:a:easysoft:zentao_pms:*:*:*:*:*:*:*:* Versions — — ·easysoft

Remediation

The sources list no fixed version for EasySoft ZenTao PMS.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-121514
  2. 2026-11-03 CISA SSVC decision points changed
  3. 2026-11-03 Alias added: GHSA-8xgp-wvrv-hg89

References

—

  • TI-2026-75080 ZenTao PMS Authorization Bypass via action::editComment CVSS 4.0MEDIUM 5.3
  • TI-2026-83119 Missing authorization in ZenTao PMS lets users read private documents CVSS 4.0HIGH 7.1
  • TI-2026-78772 ZenTao PMS Authorization Bypass via Ajax Controller Methods CVSS 4.0HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences