Is CVE-2026-114391 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114391 being exploited in the wild.

How severe is CVE-2026-114391?

High severity, with a CVSS score of 7.1, published 21 October 2026.

Which products and versions are affected?

Easysoft ZenTao PMS before 22.3.

Is there a fix for CVE-2026-114391?

Yes: fixed in 22.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-114391 attacked?

It is attacked over the network.

Am I affected by CVE-2026-114391?

Check whether you run Easysoft ZenTao PMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114391: ZenTao PMS authorization bypass in commonModel::isOpenMethod()

CVE-2026-114391 · Severity: high · CVSS 7.1 · Published 2026-10-21

ZenTao PMS is a project management system used by organizations to plan and track work. The system improperly checks permissions for methods containing 'ajax' in their names, allowing any logged-in user to bypass access controls and perform privileged actions. A low-privilege user could read sensitive data, steal database credentials, trigger deployment jobs, or modify database tables without authorization.

Technologies: Easysoft ZenTao PMS. Vendors: Easysoft.

Quick answers

Is CVE-2026-114391 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114391 being exploited in the wild.
How severe is CVE-2026-114391?: High severity, with a CVSS score of 7.1, published 21 October 2026.
Which products and versions are affected?: Easysoft ZenTao PMS before 22.3.
Is there a fix for CVE-2026-114391?: Yes: fixed in 22.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114391 attacked?: It is attacked over the network.
Am I affected by CVE-2026-114391?: Check whether you run Easysoft ZenTao PMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 22.3

Technical details

The commonModel::isOpenMethod() function in ZenTao PMS before version 22.3 fails to properly enforce group-based access control (ACL) for any method name containing 'ajax'. An authenticated attacker can call methods such as task.ajaxGetByID, system.ajaxDBAuthUrl, and admin.ajaxChangeTableEngine to read restricted data, obtain database credentials, trigger CI/CD pipelines, and alter database tables. The vulnerability requires valid login credentials but no special privilege level.

Affected products

Easysoft ZenTao PMS before 22.3

Timeline

2026-10-21: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.