CVE-2026-111352— ThinkCMF through 8.0.1 Incorrect Authorization in Admin REST API
Quick assessment
Affected
ThinkCMF ThinkCMF
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
ThinkCMF 8.0.1 及更早版本中存在一个错误授权漏洞，位于 RestAdminBaseController 中。该漏洞允许受限的后端管理员调用所有管理员 REST API 端点，因为在不存在 admin_api 规则时，Auth::check() 会开放权限（即默认返回 true）。拥有有效管理员类型 API 令牌的攻击者可以列出成员的电子邮件和手机号码，禁用成员，并调用 PUT admin/roles/{id}/authorize 来获取完全的管理员权限。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-111352
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ThinkCMF through 8.0.1 Incorrect Authorization in Admin REST API
Source: CVE Program / CVE List V5
Vulnerability Description
ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check() fails open when no admin_api rule exists. Attackers with a valid admin-type API token can list member emails and mobile numbers, disable members, and call PUT admin/roles/{id}/authorize to grant themselves full administrator rights.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-111352
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-111352
请登录查看更多情报信息。
Other References for CVE-2026-111352 (5)
-
https://github.com/thinkcmf/cmf-core/blob/v8.0.3/src/lib/Auth.php#L40-L61 technical-description
-
https://hackmd.io/@hieuPenguinnn/thinkcmf-admin-rest-api-missing-authorization third-party-advisory
IV. Related Vulnerabilities
Same weakness: CWE-863
-
CVE-2026-111369
ClassroomIO through 1.0.0 Incorrect Authorization via Lesson -
CVE-2026-111332
OxiCloud 0.9.1 through 0.9.3 Incorrect Authorization via Sha -
CVE-2026-45165
Idira Secrets Manager (Self-Hosted): Improper Authorization -
CVE-2026-111231
Netgate pfSense CE through 2.9.0 Authorization Bypass via co -
CVE-2026-71490
OPNsense: Direct comma-separated user privileges bypass OPNs
V. Comments for CVE-2026-111352
No comments yet