---
id: "CVE-2026-121514"
kind: "vulnerability"
aliases: ["CVE-2026-121514"]
title: "ZenTao PMS: user group change flaw allows improper privilege escalation remotely"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "project-management", "self-hosted", "zentao"]
not_affected_if: ["unknown"]
published_at: "2026-11-03T21:17:37+00:00"
first_seen_at: "2026-11-03T21:19:30+00:00"
updated_at: "2026-11-03T21:20:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121514", "first_seen_at": "2026-11-03T21:19:30+00:00"}]
---

# ZenTao PMS: user group change flaw allows improper privilege escalation remotely

A weakness in the user module of EasySoft ZenTao PMS up to version 22.6 lets a manipulated group argument change privileges improperly. Remote exploitation is possible, which could let an attacker gain access beyond what their account allows.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed ZenTao version and see whether it is 22.6 or older.
- Review the file `module/user/model.php` for the `checkGroupChange` function.

## Timeline

- 2026-11-03T21:19:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121514

## From the sources

A weakness has been identified in EasySoft ZenTao PMS up to 22.6. This impacts the function userModel::checkGroupChange of the file module/user/model.php of the component User Module. This manipulation of the argument group causes improper privilege management. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_