CVE-2026-114391 — ZenTao PMS before 22.3 Authorization Bypass via Ajax Controller Methods
ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for any method contain…
Published: 2026-10-21 · CVSS: 7.1 · CVSS 4.0
ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like task.ajaxGetByID, system.ajaxDBAuthUrl and admin.ajaxChangeTableEngine to read data, obtain database credentials, trigger CI jobs and alter tables.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7