CVE-2026-121514: EasySoft ZenTao PMS User model.php checkGroupChange privileges management
A weakness has been identified in EasySoft ZenTao PMS up to 22.6. This impacts the function userModel::checkGroupChange of the file module/user/model.php of the component User Module. This manipulation of the argument group causes improper privilege management. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.
Event History
Frequently Asked Questions
Which deployments are affected?
EasySoft ZenTao PMS versions up to and including 22.6 are identified as affected. The issue is in the User Module, specifically userModel::checkGroupChange in module/user/model.php.
What access does an attacker need?
The vulnerability is remotely exploitable over the network, but the severity vector indicates that the attacker requires low-level privileges. No user interaction is required.
What is the impact of successful exploitation?
Manipulating the group argument can result in improper privilege management. The reported impact includes limited compromise of confidentiality, integrity, and availability.
Is a vendor fix available?
The available data does not identify a fixed version or workaround. The vendor was contacted before disclosure but did not respond.