ZenTao PMS CVE-2026-121514

Exploitation requires an authenticated, low-privileged ZenTao PMS account (CVSS PR:L) and the ability to reach the User Module over the network (AV:N). The specific prerequisite is invoking the userModel::checkGroupChange function in module/user/model.php with a manipulated 'group' argument, which is subject to improper privilege management (CWE-269). No special non-default configuration is indicated and no user interaction is required (UI:N). Limiting factors: the attacker must first possess valid low-privilege credentials, impacts are limited (VC:L/VI:L/VA:L, no scope change), and the exact conditions under which the group manipulation succeeds are not detailed in the available sources.

This is a moderate, authenticated privilege-management flaw (CVSS 4.0 base 5.3) rather than a high-urgency emergency. The vector AV:N/AC:L/AT:N/PR:L/UI:N shows a network-reachable, low-complexity attack but one that requires an existing low-privileged authenticated account (PR:L), and the impacts are uniformly Low (VC:L/VI:L/VA:L) with no scope change - consistent with a user able to improperly alter group membership rather than achieve full administrative takeover. The vuln.today decision label is 'this_month', which signals a prioritize-but-not-drop-everything posture. No EPSS probability, no CISA KEV listing, and no confirmed working exploit are present in the supplied data, so there is no evidence of active exploitation; exploitation status is 'no public exploit identified at time of analysis'. Key limitation: the intelligence comes from a single source (VulDB) and the vendor did not respond to disclosure, so affected-version scope ('up to 22.6') and the absence of a fix are vendor-unconfirmed. Conflicting/missing signals to note: EPSS is absent (not low - simply not provided), so probability of exploitation cannot be quantified from this data, and the exact trigger beyond 'manipulation of the group argument' is not described.

An attacker who already holds a low-privileged ZenTao PMS account submits a crafted value for the 'group' argument handled by userModel::checkGroupChange, exploiting improper privilege management to change or assign group membership they should not control. Because the CVSS vector is PR:L with Low impacts, this yields limited privilege escalation rather than full compromise, and no public exploit code is identified at time of analysis.