Read the docs
TI-2026-75086 Aliases CVE-2026-111352

ThinkCMF admin REST API lets restricted admins gain full rights

Priority HIGH 73CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

ThinkCMF through 8.0.1 has an incorrect authorization flaw in the RestAdminBaseController class (CWE-863). The authorization check fails open when no admin_api rule exists, so restricted backend administrators can call every admin REST API endpoint. An attacker with a valid admin-type API token can list member emails and mobile numbers, disable members, and grant themselves full administrator rights.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check() fails open when no admin_api rule exists. Attackers with a valid admin-type API token can list member emails and mobile numbers, disable members, and call PUT admin/roles/{id}/authorize to grant themselves full administrator rights.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00458 39th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ThinkCMFThinkCMFup to 8.0.1—No fix listedCNA
  • ThinkCMF VendorThinkCMF Affected up to 8.0.1 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for ThinkCMF.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-111352
  2. 2026-10-16 Priority changed: MEDIUM → LOW
  3. 2026-10-23 CISA SSVC decision points changed
  4. 2026-10-23 Priority changed: LOW → HIGH

References

Advisory 1

Other 3

  • TI-2024-20894 ThinkCMF 6.0.9 is vulnerable to File upload via UeditorController.php. CVSS 3.1CRITICAL 9.8
  • TI-2022-19215 ThinkCMF version 6.0.7 is affected by a Cross Site Request Forgery (CSRF) vulnerability… CVSS 3.1HIGH 8.8
  • TI-2022-19439 ThinkCMF version 6.0.7 is affected by Stored Cross-Site Scripting (XSS). CVSS 3.1MEDIUM 5.4
  • TI-2020-15874 Cross Site Scripting (XSS) vulnerability in UserController.php in ThinkCMF version 5.1.5… CVSS 3.1MEDIUM 5.4
  • TI-2020-13886 An issue in ThinkCMF X2.2.2 and below allows attackers to execute arbitrary code via a crafted packet. CVSS 3.1CRITICAL 9.8
  • TI-2019-05352 ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code via the… CVSS 3.0HIGH 8.8
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences