CVE-2026-121514
Medium · 6.3CVSS
6.3
EPSS
0.2%
Published
Nov 3, 2026
CISA due date
—
The record
A weakness has been identified in EasySoft ZenTao PMS up to 22.6. This impacts the function userModel::checkGroupChange of the file module/user/model.php of the component User Module. This manipulation of the argument group causes improper privilege management. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-121539 A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87/2.1.38. CWE-266
- CVE-2026-119922 Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5… CWE-266
- CVE-2026-120224 A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. CWE-266
- CVE-2026-120185 A security flaw has been discovered in ken678 YznCMS up to 2.2.0. CWE-266
- CVE-2026-54854 Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions. CWE-266
- CVE-2026-118086 Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions. CWE-266
- CVE-2026-116386 Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions. CWE-266
- CVE-2026-119599 AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows… CWE-266