Incorrect Authorization in ThinkCMF by ThinkCMF
CVE-2026-111352

8.7HIGH

Key Information:

Vendor

Thinkcmf

Status
Thinkcmf
Vendor
CVE Published:
15 October 2026

What is CVE-2026-111352?

An incorrect authorization vulnerability exists in ThinkCMF up to version 8.0.1, specifically within the RestAdminBaseController. This flaw allows restricted backend administrators to access and invoke all admin REST API endpoints due to the failure of Auth::check() when no admin_api rule is defined. Consequently, attackers with a valid admin-type API token can exploit this vulnerability to access sensitive member data (including emails and mobile numbers), disable accounts, and potentially escalate their privileges to assume full administrative control by calling appropriate API endpoints.

Affected Version(s)

ThinkCMF 0 <= 8.0.1

References

https://hackmd.io/@hieuPenguinnn/thinkcmf-admin-rest-api-...
third-party-advisory
https://github.com/thinkcmf/cmf-core/blob/v8.0.3/src/lib/...
technical-description
https://github.com/thinkcmf/cmf-core/blob/v8.0.3/src/cont...
technical-description

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.