ZenTao PMS CVE-2026-114391

Exploitation requires an authenticated session as a minimal-privilege ZenTao user (PR:L); it is not remote-unauthenticated. The vulnerability is present in default configurations of ZenTao PMS before 22.3 because commonModel::isOpenMethod() unconditionally treats any method whose name contains the substring 'ajax' as publicly accessible, bypassing group-based ACL - no special feature toggle or non-default setting is needed. The practical limiting factor is that the attacker must already hold valid credentials for a low-privilege account; there is no user-interaction requirement and no platform-specific constraint. Upgrading to 22.3 (which adds the config/privilege.php allow-list) removes the condition.

This is a credentialed authorization-bypass (CWE-863) in ZenTao PMS before 22.3, rated CVSS 4.0 7.1 (High) with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N. The signals are internally consistent: network-reachable, low attack complexity, no user interaction, but requiring an existing authenticated low-privilege account (PR:L), with high confidentiality impact (data read plus database credential disclosure) and limited integrity impact (triggering CI jobs, altering tables). No EPSS score was provided in the input and the CVE is not listed in CISA KEV, so there is no evidence of active exploitation; the finding was reported by VulnCheck, a credible research source, and a vendor patch plus commit are available. The root cause is clearly documented in source (commonModel::isOpenMethod() treating any method name containing 'ajax' as open), and the fix adds an explicit privilege.php allow-list, which strongly corroborates the vulnerability. Realistic priority is moderate-to-high for organizations running ZenTao with many low-trust internal users, because any authenticated minimal-privilege account can reach sensitive methods; it is lower for deployments where accounts are tightly controlled. Note: EPSS and POC availability are unknown from the provided data, so the exploitation-likelihood dimension cannot be fully quantified - treat the practical urgency as patch-promptly rather than emergency.

An attacker with any low-privilege authenticated ZenTao account (or a compromised employee login) sends requests to ACL-bypassing endpoints such as system.ajaxDBAuthUrl to harvest database credentials and task.ajaxGetByID to read records they should not see. With the leaked DB credentials or admin.ajaxChangeTableEngine, they can then manipulate backend data or pivot to the database. No public exploit was identified in the provided data, though the bypass logic is fully disclosed in the patched source.