Live › vulnerability › CVE-2026-121514
A weakness in the user module of EasySoft ZenTao PMS up to version 22.6 lets a manipulated group argument change privileges improperly. Remote exploitation is possible, which could let an attacker gain access beyond what their account allows.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Teams that run self-hosted ZenTao PMS at version 22.6 or older are exposed. The sources do not say which configurations or roles are required, and the vendor did not respond to the disclosure.
No product ranges from the sources yet.
module/user/model.php for the checkGroupChange function.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A weakness has been identified in EasySoft ZenTao PMS up to 22.6. This impacts the function userModel::checkGroupChange of the file module/user/model.php of the component User Module. This manipulation of the argument group causes improper privilege management. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-121514")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.