Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-114391— ZenTao PMS before 22.3 Authorization Bypass via Ajax Controller Methods

Quick assessment

Affected
easysoft zentaopms
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ZenTao PMS 22.3 之前的版本在 函数中存在一个授权绕过漏洞。该漏洞允许已登录用户跳过基于角色的访问控制（ACL）检查，从而调用任何方法名中包含 "ajax" 的方法。即使是最小权限的用户，也可以调用诸如 、 和 等方法，进而读取敏感数据、获取数据库凭据、触发持续集成（CI）任务以及修改数据库表结构。

CVSS 7.1 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-114391

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ZenTao PMS before 22.3 Authorization Bypass via Ajax Controller Methods
Source: CVE Program / CVE List V5
Vulnerability Description
ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like task.ajaxGetByID, system.ajaxDBAuthUrl and admin.ajaxChangeTableEngine to read data, obtain database credentials, trigger CI jobs and alter tables.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
easysoft zentaopms 0 ~ 22.3 -

II. Public POCs for CVE-2026-114391

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-114391

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-114391 (1)

Vendor Advisories for CVE-2026-114391 (1)

Proof of Concept for CVE-2026-114391 (1)

Vendor Pages for CVE-2026-114391 (2)

IV. Related Vulnerabilities

Same product: zentaopms
Same vendor: easysoft
Same weakness: CWE-863

V. Comments for CVE-2026-114391

No comments yet

Leave a comment