CVE-2026-114391

ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like task.ajaxGetByID, system.ajaxDBAuthUrl and...

CVE-2026-114391 ZenTao PMS before 22.3 Authorization Bypass via Ajax Controller Methods

ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like task.ajaxGetByID, system.ajaxDBAuthUrl and...

CVE-2026-114391

ZenTao PMS versions prior to 22.3 are vulnerable to an authorization bypass within the commonModel::isOpenMethod() function. This flaw allows logged-in users to circumvent group-based ACL checks for any method containing the string 'ajax '. Consequently, users with minimal privileges can execute ...

EUVD-2026-107238

ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like task.ajaxGetByID, system.ajaxDBAuthUrl and...

PT-2026-120578

ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like task.ajaxGetByID, system.ajaxDBAuthUrl and...