CVE-2026-111352
8.8 HIGHpublic exploit availablePublished 2026-10-15 · Updated 2026-10-16
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check() fails open when no admin_api rule exists. Attackers with a valid admin-type API token can list member emails and mobile numbers, disable members, and call PUT admin/roles/{id}/authorize to grant themselves full administrator rights.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-863
Public exploit & PoC references
All references
- https://github.com/thinkcmf/cmf-api/blob/v8.0.7/src/admin/controller/RoleController.php#L345-L381
- https://github.com/thinkcmf/cmf-core/blob/v8.0.3/src/controller/RestAdminBaseController.php#L15-L34
- https://github.com/thinkcmf/cmf-core/blob/v8.0.3/src/lib/Auth.php#L40-L61
- https://hackmd.io/@hieuPenguinnn/thinkcmf-admin-rest-api-missing-authorization
- https://www.vulncheck.com/advisories/thinkcmf-through-8.0.1-incorrect-authorization-in-admin-rest-api
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2024-22031PoC
- MEDIUMCVE-2026-100259
- HIGHCVE-2026-100262
- LOWCVE-2026-100270
- HIGHCVE-2026-100273
- MEDIUMCVE-2026-100276
- HIGHCVE-2026-100277
- MEDIUMCVE-2026-100278
Related by shared AI tags and CWE weakness class. Browse the full archive.