CVE-2026-114391 ZenTao PMS before 22.3 Authorization Bypass via Ajax Controller Methods

High 7.1 Published 21 Oct 2026 Updated 21 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-114391?

CVE-2026-114391 is a high-severity vulnerability in easysoft zentaopms, published on 21 Oct 2026.

Official description

ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like task.ajaxGetByID, system.ajaxDBAuthUrl and admin.ajaxChangeTableEngine to read data, obtain database credentials, trigger CI jobs and alter tables.

Weakness: CWE-863

Which versions are affected by CVE-2026-114391?

How do I fix CVE-2026-114391?

No fix has been published for CVE-2026-114391 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-114391 being exploited?

There is no known exploitation of CVE-2026-114391 in the wild and no public exploit code.

Sources

Also known as GHSA-crpg-r4ww-5jx4.