Live › vulnerability › CVE-2026-114391
Go to dashboardZenTao PMS before 22.3 skips group-based access checks for any method whose name contains 'ajax' in commonModel::isOpenMethod(). A logged-in user with minimal privileges can call those methods to read data, obtain database credentials, trigger CI jobs and alter database tables.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any self-hosted ZenTao PMS instance before 22.3 where users can log in is exposed, because the flaw needs only a valid account with minimal privileges. Instances that restrict logins to trusted staff have a smaller exposure window but still need the upgrade. Teams on a current release can skip it.
No product ranges from the sources yet.
22.3 are affected.22.3 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like task.ajaxGetByID, system.ajaxDBAuthUrl and admin.ajaxChangeTableEngine to read data, obtain database credentials, trigger CI jobs and alter tables.
This page as .md · .json · in your agent: get_signal("CVE-2026-114391")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.