HIGH 8.7 NVD
CVE-2026-111352
ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every
ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check() fails open when no admin_api rule exists. Attackers with a valid admin-type API token can list member emails and mobile numbers, disable members, and call PUT admin/roles/{id}/authorize to grant themselves full administrator rights.
References
- https://github.com/thinkcmf/cmf-api/blob/v8.0.7/src/admin/controller/RoleController.php#L3
- https://github.com/thinkcmf/cmf-core/blob/v8.0.3/src/controller/RestAdminBaseController.ph
- https://github.com/thinkcmf/cmf-core/blob/v8.0.3/src/lib/Auth.php#L40-L61
- https://hackmd.io/@hieuPenguinnn/thinkcmf-admin-rest-api-missing-authorization
- https://www.vulncheck.com/advisories/thinkcmf-through-8.0.1-incorrect-authorization-in-adm
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-10-15 via NVD.
vulnfeed aggregates 14677 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.