CVE-2026-121514
Deferred
Deferred - Pending Action
Improper Privilege Management in EasySoft ZenTao PMS
Vulnerability report for CVE-2026-121514, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-03
Last updated on: 2026-11-03
Assigner: VulDB
Description
Description
A weakness has been identified in EasySoft ZenTao PMS up to 22.6. This impacts the function userModel::checkGroupChange of the file module/user/model.php of the component User Module. This manipulation of the argument group causes improper privilege management. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| EasySoft | ZenTao PMS | 22.0 |
| EasySoft | ZenTao PMS | 22.1 |
| EasySoft | ZenTao PMS | 22.2 |
| EasySoft | ZenTao PMS | 22.3 |
| EasySoft | ZenTao PMS | 22.4 |
| EasySoft | ZenTao PMS | 22.5 |
| EasySoft | ZenTao PMS | 22.6 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
