{"id":"CVE-2026-121514","kind":"vulnerability","aliases":["CVE-2026-121514"],"related":[],"title":"ZenTao PMS: user group change flaw allows improper privilege escalation remotely","description":"A weakness has been identified in EasySoft ZenTao PMS up to 22.6. This impacts the function userModel::checkGroupChange of the file module/user/model.php of the component User Module. This manipulation of the argument group causes improper privilege management. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"A weakness in the user module of EasySoft ZenTao PMS up to version 22.6 lets a manipulated group argument change privileges improperly. Remote exploitation is possible, which could let an attacker gain access beyond what their account allows.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","project-management","self-hosted","zentao"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed ZenTao version and see whether it is 22.6 or older.\n- Review the file `module/user/model.php` for the `checkGroupChange` function.","fix":null,"status":"open","published_at":"2026-11-03T21:17:37+00:00","first_seen_at":"2026-11-03T21:19:30+00:00","triaged_at":"2026-11-03T21:20:40+00:00","updated_at":"2026-11-03T21:20:40+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-03T21:20:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"ZenTao PMS: user group change flaw allows improper privilege escalation remotely","impact":"high","summary":"A weakness in the user module of EasySoft ZenTao PMS up to version 22.6 lets a manipulated group argument change privileges improperly. Remote exploitation is possible, which could let an attacker gain access beyond what their account allows.","audience":"businesses","category":"package","nicknames":[],"who_cares":["zentao","self-hosted","project-management"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker changes user group and gains elevated privileges","analyst_note":"Confirm whether an authenticated account is required and whether a fixed version or vendor advisory exists; the vendor did not respond.","how_to_check":"- Check the installed ZenTao version and see whether it is 22.6 or older.\n- Review the file `module/user/model.php` for the `checkGroupChange` function.","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams that run self-hosted ZenTao PMS at version 22.6 or older are exposed. The sources do not say which configurations or roles are required, and the vendor did not respond to the disclosure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000657,"input_tokens":4137,"output_tokens":487,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121514':14A,17A '-2026':13A,16A '22.6':39B,75C 'access':58B 'account':62B 'allow':7A,63B 'argument':44B,95C 'attack':56B,105C 'beyond':59B 'caus':97C 'chang':5A,45B 'checkgroupchang':81C 'compon':88C 'contact':111C 'could':53B 'cve':12A,15A 'disclosur':115C 'earli':112C 'easysoft':33B,70C 'escal':10A 'exploit':49B,102C 'file':84C 'flaw':6A 'function':79C 'gain':57B 'group':4A,43B,96C 'host':24B 'identifi':68C 'impact':77C 'improp':8A,47B,98C 'let':40B,54B 'manag':21B,100C 'manipul':42B,92C 'modul':31B,90C 'module/user/model.php':85C 'packag':18B 'pms':2A,35B,72C 'possibl':51B,107C 'privileg':9A,46B,99C 'project':20B 'project-manag':19B 'remot':11A,48B,101C 'respond':119C 'self':23B 'self-host':22B 'user':3A,30B,89C 'usermodel':80C 'vendor':109C 'version':38B 'way':122C 'weak':27B,65C 'zentao':1A,25B,34B,71C","nicknames":[],"mitigations":[],"who_affected":"Teams that run self-hosted ZenTao PMS at version 22.6 or older are exposed. The sources do not say which configurations or roles are required, and the vendor did not respond to the disclosure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","projectmanagement","selfhosted","zentao"],"campaign_type":null,"first_public_at":"2026-11-03T21:17:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121514","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121514","severity":null,"published_at":"2026-11-03T21:17:37+00:00","modified_at":"2026-11-03T21:17:37+00:00","first_seen_at":"2026-11-03T21:19:30+00:00","fetched_at":"2026-11-03T21:19:30+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}