CVE-2026-114391Published
ZenTao PMS before 22.3 Authorization Bypass via Ajax Controller Methods
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-114391 · Microsoft / collected KEV context
cve-program · CVE-2026-114391
- https://github.com/easysoft/zentaopms/issues/181
- https://github.com/easysoft/zentaopms/commit/ac484f3b01c0f84002391a344d99dd2993692f49
- https://github.com/easysoft/zentaopms/releases/tag/zentaopms_22.3_20260707
- https://github.com/easysoft/zentaopms/blob/zentaopms_22.2_20260527/module/common/model.php#L446-L463
- https://github.com/easysoft/zentaopms/blob/zentaopms_22.2_20260527/module/system/control.php#L454-L474
- https://www.vulncheck.com/advisories/zentao-pms-before-22.3-authorization-bypass-via-ajax-controller-methods
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.