The issue is in ZenTao PMS prior to version 22.3, where the commonModel::isOpenMethod function permits logged‑in users to bypass group‑based access control checks for any method containing "ajax". Attackers with minimal privilege can invoke otherwise restricted actions such as task.ajaxGetByID, system.ajaxDBAuthUrl, and admin.ajaxChangeTableEngine, potentially exposing sensitive data, retrieving database credentials, triggering CI jobs, or altering database tables—leading to significant confidentiality, integrity, and availability damage.

ZenTao PMS developed by easysoft is affected in all releases older than 22.3, including 22.2 and earlier. Any installation that has not been upgraded to the 22.3 release or later remains vulnerable.

The CVSS score of 7.1 indicates a high severity. The vulnerability requires authentication within the web application, so an attacker only needs legitimate credentials to exploit it. Because the bypass allows a broad range of privileged operations, a compromised user could potentially access or modify the underlying database or execute arbitrary logic. The vulnerability is not listed in the CISA KEV catalog and its EPSS score is not available, but the known impact justifies a high risk posture.