CVE-2026-111352

HIGH 8.8

ThinkCMF through 8.0.1 Incorrect Authorization in Admin REST API

CVSS Score

8.8

EPSS Score

0.0%

EPSS Percentile

0th

ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check() fails open when no admin_api rule exists. Attackers with a valid admin-type API token can list member emails and mobile numbers, disable members, and call PUT admin/roles/{id}/authorize to grant themselves full administrator rights.

CWE	CWE-863
Vendor	thinkcmf
Product	thinkcmf
Published	Oct 15, 2026

Stay Ahead of the Next One

Get instant alerts for thinkcmf thinkcmf

Be the first to know when new high vulnerabilities affecting thinkcmf thinkcmf are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

ThinkCMF / ThinkCMF

0 ≤ 8.0.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

hackmd.io: https://hackmd.io/@hieuPenguinnn/thinkcmf-admin-rest-api-missing-authorization github.com: https://github.com/thinkcmf/cmf-core/blob/v8.0.3/src/lib/Auth.php#L40-L61 github.com: https://github.com/thinkcmf/cmf-core/blob/v8.0.3/src/controller/RestAdminBaseController.php#L15-L34 github.com: https://github.com/thinkcmf/cmf-api/blob/v8.0.7/src/admin/controller/RoleController.php#L345-L381 vulncheck.com: https://www.vulncheck.com/advisories/thinkcmf-through-8.0.1-incorrect-authorization-in-admin-rest-api

Credits

hieuPenguinnn