Skip to content
Heist/ feed
Back to feed
High

ZenTao PMS before 22.3 Authorization Bypass via Ajax Controller Methods

Type: advisorySources: OSV

ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like task.ajaxGetByID, system.ajaxDBAuthUrl and admin.ajaxChangeTableEngine to read data, obtain database credentials, trigger CI jobs and alter tables.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-114391
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 15:06 UTC · Revision 1

Source evidence

ZenTao PMS before 22.3 Authorization Bypass via Ajax Controller Methods

core-osv · Original source

Published 21 Oct 2026, 12:39 UTC

ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like task.ajaxGetByID, system.ajaxDBAuthUrl and admin.ajaxChangeTableEngine to read data, obtain database credentials, trigger CI jobs and alter tables.

osv:CVE-2026-114391
Complete source record
{
  "id": "256ed8716fe832e8a9ef75b544d10cd90b472aca21f7d5eec6e7882a439c0353",
  "url": "https://osv.dev/vulnerability/CVE-2026-114391",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "ZenTao PMS before 22.3 Authorization Bypass via Ajax Controller Methods",
    "summary": "ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like task.ajaxGetByID, system.ajaxDBAuthUrl and admin.ajaxChangeTableEngine to read data, obtain database credentials, trigger CI jobs and alter tables.",
    "evidence": "osv:CVE-2026-114391",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-114391",
      "aliases": [
        "CVE-2026-114391"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/easysoft/zentaopms",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "e97bcf7f42da7d76d753db72c321da5527854fa2"
                },
                {
                  "fixed": "ac484f3b01c0f84002391a344d99dd2993692f49"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "22.3"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "fixed": "ac484f3b01c0f84002391a344d99dd2993692f49"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "e97bcf7f42da7d76d753db72c321da5527854fa2"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "zentaopms_22.3_20260707"
                  }
                ]
              }
            }
          ],
          "versions": [
            "zentaopms_22.2_20260527",
            "zentaopms_21.6_20250414",
            "zentaopms_21.6_20250411",
            "zentaopms_21.6.beta_20250321",
            "zentaopms_21.5_20250307",
            "zentaopms_21.5_20250306",
            "zentaopms_21.4_20250115",
            "zentaopms_21.3_20241227",
            "zentaopms_21.2_20241205",
            "zentaopms_21.0_20241106",
            "zentaopms_21.0_20241104",
            "zentaopms_20.8_20241022",
            "zentaopms_20.7.1_20240930",
            "zentaopms_20.7_20240914",
            "zentaopms_20.6_20240902",
            "zentaopms_20.6_20240830",
            "zentaopms_20.5_20240819",
            "zentaopms_20.5_20240816",
            "zentaopms_20.4_20240805",
            "zentaopms_20.4_20240803",
            "zentaopms_20.4_20240802",
            "zentaopms_20.3.0_20240722",
            "zentaopms_20.2.0_20240710",
            "zentaopms_20.1.1_20240614",
            "zentaopms_20.0.beta1",
            "zentaopms_18.3",
            "zentaopms_18.1",
            "zentaopms_18.0.beta2",
            "zentaopms_18.0.beta1",
            "zentaopms_17.8",
            "zentaopms_17.7",
            "zentaopms_17.6.2",
            "zentaopms_17.6",
            "zentaopms_17.1",
            "zentaopms_17.0",
            "zentaopms_16.5.beta1",
            "zentaopms_16.4",
            "zentaopms_16.3",
            "zentaopms_16.2",
            "zentaopms_16.0",
            "zentaopms_16.0.beta1",
            "zentaopms_16.0.beta1_20211207",
            "zentaopms_15.8_20211122",
            "zentaopms_15.7.1_20211102",
            "zentaopms_15.5_20210914",
            "zentaopms_15.4_20210823",
            "zentaopms_15.3_20210804",
            "zentaopms_15.2_20210720",
            "zentaopms_15.0.1_20210606",
            "zentaopms_20.0.beta4_20210202",
            "zentaopms_13.0.beta4_20210202",
            "zentaopms_20.beta2_20201218",
            "zentaopms_13.beta2_20201218",
            "zentaopms_20.0.beta1_20201201",
            "zentaopms_13.0.beta1_20201201",
            "zentaopms_20.0.alpha2_20201123",
            "zentaopms_13.0.alpha2_20201123",
            "zentaopms_13.0.alpha1_20201103",
            "zentaopms_20.0.alpha1_20201103",
            "zentaopms_20.0.alpha_20201030_1",
            "zentaopms_20.0._20201022",
            "zentaopms_13.0._20201022",
            "zentaopms_12.3.3_20200707",
            "zentaopms_12.3.2_20200601",
            "zentaopms_12.0.stable_20200103",
            "zentaopms_11.7.stable_20191129",
            "zentaopms_11.6.4_20191017",
            "zentaopms_11.6.3_20190924",
            "zentaopms_11.6.2_20190906",
            "zentaopms_11.6.1_20190823",
            "zentaopms_11.6.0.beta1_20190705",
            "zentaopms_11.4.stable_20190325",
            "zentaopms_11.5.stable_20190508",
            "zentao_11.2_build1_20190128",
            "zentaopms_11.1.stable_20190104",
            "zentaopms_11.0.stable_20181221",
            "zentaopms_10.6.stable_20181120",
            "zentaopms_10.5.1_20181105",
            "zentaopms_10.4.stable_20180928",
            "zentaopms_10.3.1_20180907",
            "zentaopms_10.3_20170809",
            "zentaopms_10.1_20180716",
            "zentaopms_9.6.1_20171113",
            "zentaopms_9.6_20171106",
            "zentaopms_9.5.1_20170927",
            "zentaopms_9.4_20170726",
            "zentaopms_9.3.beta_20170627",
            "zentaopms_9.2.1_20170522",
            "zentaopms_9.2.stable_20170516",
            "zentaopms_9.1.2_20170419",
            "zentaopms_9.1.1_20170410",
            "zentaopms_9.0.1_20170215",
            "zentaopms_9.0.stable_20170117",
            "zentaopms_8.4.1_20161212",
            "zentaopms_8.4.stable_20161206",
            "zentaopms_8.3.stable_20161109",
            "zentaopms_8.2.6_20160913",
            "zentaopms_8.2.5_20160805",
            "zentaopms_8.2.4_20160628",
            "zentaopms_8.3.4_20160628",
            "zentaopms_8.2.3_20160624",
            "zentaopms_8.2.2_20160608",
            "zentaopms_8.2.1_20160524",
            "zentaopms_8.2.stable_20160517",
            "zentaopms_8.2.beta_20160504",
            "zentaopms_8.1.3_20160323",
            "zentaopms_8.1.stable_20160315",
            "zentaopms_8.0.1_20151224",
            "zentaopms_8.0.stable_20151127",
            "zentaopms_7.3.stable_20150918",
            "zentaopms_7.2.5_20150807",
            "zentaopms_7.2.4_20150703",
            "zentaopms_7.2.stable_20150525",
            "zentaopms_7.1.stable_20150317",
            "zentaopms_7.0.stable_20150206",
            "zentaopms_6.4.stable_20141223",
            "zentaopms_6.3.stable_20141107",
            "zentaopms_6.2.stable_20140827",
            "zentaopms_6.1.stable_20140806",
            "zentaopms_6.1.stable_20140805",
            "zentaopms_6.0.stable_20140625",
            "zentaopms_6.0.beta1_20140503",
            "zentaopms_5.0.beta1_20130809",
            "zentaopms_4.3.beta_20130805"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114391.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:36.620927352Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114391.json",
        "https://github.com/easysoft/zentaopms/releases/tag/zentaopms_22.3_20260707",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-114391",
        "https://www.vulncheck.com/advisories/zentao-pms-before-22.3-authorization-bypass-via-ajax-controller-methods",
        "https://github.com/easysoft/zentaopms/issues/181",
        "https://github.com/easysoft/zentaopms/commit/ac484f3b01c0f84002391a344d99dd2993692f49",
        "https://github.com/easysoft/zentaopms",
        "https://github.com/easysoft/zentaopms/blob/zentaopms_22.2_20260527/module/common/model.php#L446-L463",
        "https://github.com/easysoft/zentaopms/blob/zentaopms_22.2_20260527/module/system/control.php#L454-L474"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-863"
        ],
        "cna_assigner": "VulnCheck",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114391.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-114391",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 503965,
  "published_at": "2026-10-21T12:39:47.378+00:00"
}