CVE-2026-121514

A weakness has been identified in EasySoft ZenTao PMS up to 22.6. This impacts the function userModel::checkGroupChange of the file module/user/model.php of the component User Module. This manipulation of the argument group causes improper privilege management. Remote exploitation of the attack i...

EUVD-2026-116371

A weakness has been identified in EasySoft ZenTao PMS up to 22.6. This impacts the function userModel::checkGroupChange of the file module/user/model.php of the component User Module. This manipulation of the argument group causes improper privilege management. Remote exploitation of the attack i...

CVE-2026-121514

A weakness exists in EasySoft ZenTao PMS (up to version 22.6) within the User Module component. Specifically, the function userModel::checkGroupChange in the file module/user/model.php is susceptible to manipulation of the argument group, leading to improper privilege management . This vulnerabil...

CVE-2026-121514 EasySoft ZenTao PMS User model.php checkGroupChange privileges management

A weakness has been identified in EasySoft ZenTao PMS up to 22.6. This impacts the function userModel::checkGroupChange of the file module/user/model.php of the component User Module. This manipulation of the argument group causes improper privilege management. Remote exploitation of the attack i...

CVE-2026-119645

ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc that allows authenticated users to read documents without checkPrivDoc access checks. Low-privilege attackers can enumerate sequential document ids to retrieve body and draft content of private documents and...

CVE-2026-119645 ZenTao PMS through 22.6 Missing Authorization via doc.ajaxGetDoc

ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc that allows authenticated users to read documents without checkPrivDoc access checks. Low-privilege attackers can enumerate sequential document ids to retrieve body and draft content of private documents and...

CVE-2026-119645 ZenTao PMS through 22.6 Missing Authorization via doc.ajaxGetDoc

ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc that allows authenticated users to read documents without checkPrivDoc access checks. Low-privilege attackers can enumerate sequential document ids to retrieve body and draft content of private documents and...

EUVD-2026-114061

ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc that allows authenticated users to read documents without checkPrivDoc access checks. Low-privilege attackers can enumerate sequential document ids to retrieve body and draft content of private documents and...

CVE-2026-119645

ZenTao PMS versions up to 22.6 are vulnerable to a missing authorization flaw in the doc::ajaxGetDoc() function. The root cause is the omission of checkPrivDoc() access checks, allowing authenticated low-privilege users to bypass permission controls. By enumerating sequential document IDs, an att...

CVE-2026-119645 ZenTao PMS through 22.6 Missing Authorization via doc.ajaxGetDoc

ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc that allows authenticated users to read documents without checkPrivDoc access checks. Low-privilege attackers can enumerate sequential document ids to retrieve body and draft content of private documents and...

CVE-2026-119645: easysoft zentaopms: ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated…

ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc that allows authenticated users to read documents without checkPrivDoc access checks. Low-privilege attackers can enumerate sequential document ids to retrieve body and draft content of private documents and...

PT-2026-133575

ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc that allows authenticated users to read documents without checkPrivDoc access checks. Low-privilege attackers can enumerate sequential document ids to retrieve body and draft content of private documents and...

CVE-2026-114391

ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like task.ajaxGetByID, system.ajaxDBAuthUrl and...

CVE-2026-114391

ZenTao PMS versions prior to 22.3 are vulnerable to an authorization bypass within the commonModel::isOpenMethod() function. This flaw allows logged-in users to circumvent group-based ACL checks for any method containing the string 'ajax '. Consequently, users with minimal privileges can execute ...

EUVD-2026-107238

ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like task.ajaxGetByID, system.ajaxDBAuthUrl and...

CVE-2026-114391 ZenTao PMS before 22.3 Authorization Bypass via Ajax Controller Methods

ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like task.ajaxGetByID, system.ajaxDBAuthUrl and...

CVE-2026-114391 ZenTao PMS before 22.3 Authorization Bypass via Ajax Controller Methods

ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like task.ajaxGetByID, system.ajaxDBAuthUrl and...

CVE-2026-114391 ZenTao PMS before 22.3 Authorization Bypass via Ajax Controller Methods

ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like task.ajaxGetByID, system.ajaxDBAuthUrl and...

EasySoft ZenTao PMS authorization issue vulnerability

EasySoft ZenTao PMS versions prior to 22.3 contain an authorization issue vulnerability. This vulnerability stems from an authorization bypass in commonModel::isOpenMethod, allowing logged-in users to bypass group-based ACL checks on any method containing ‘ajax’. As a result, low-privilege users...

PT-2026-120578

ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like task.ajaxGetByID, system.ajaxDBAuthUrl and...