User Privilege Management Vulnerability in EasySoft ZenTao PMS

CVE-2026-121514

What is CVE-2026-121514?

A vulnerability has been discovered in EasySoft ZenTao PMS up to version 22.6, specifically affecting the userModel::checkGroupChange function located in the module/user/model.php file. This weakness results from insecure manipulation of the group argument, allowing attackers to exploit improper privilege management. As a consequence, unauthorized users may gain elevated privileges, potentially compromising the integrity and security of the application. Remote exploitation is feasible, posing a significant risk to systems using the affected software. Despite early notification of the vendor regarding this issue, there has been no response to address or mitigate the vulnerability.

References