CVE-2026-111352

HighCVSS 8.8

Published: 15/10/2026(UTC)Translated: 16/10/2026(UTC)NVD NIST

Summary

ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check() fails open when no admin_api rule exists. Attackers with a valid admin-type API token can list member emails and mobile numbers, disable members, and call PUT admin/roles/{id}/authorize to grant themselves full administrator rights.

Risk Assessment

Restricted administrators can gain full administrator rights, leading to complete system compromise and exposure of members' personal data. Mass listing of contact data and disabling of member accounts is possible.

Recommendation

Update ThinkCMF to a version newer than 8.0.1 if available, or implement a fix so Auth::check() defaults to deny when no admin_api rule exists. Audit admin-type API tokens and restrict their permissions.

Other vulnerabilities in ThinkCMF

CVE-2026-102771Medium
A security vulnerability has been detected in Naichen ThinkCMF up to 8.0.7. The function MailController::templatePut in cmf-api/src/admin/controller/MailController.php of the Email Template component is affected. The manipulation leads to improper neutralization of special elements used in a template engine. The attack can be carried out remotely, and the exploit has been publicly disclosed.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS