Vulnerability · Published Oct 15, 2026 · Assigned by VulnCheck

CVE-2026-111352ThinkCMF through 8.0.1 Incorrect Authorization in Admin REST API

High 8.8

In plain English

A high-severity incorrect authorization in ThinkCMF from ThinkCMF. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.5%top 60.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check() fails open when no admin_api rule exists. Attackers with a valid admin-type API token can list member emails and mobile numbers, disable members, and call PUT admin/roles/{id}/authorize to grant themselves full administrator rights.

Affected products (as reported)

Vendor	Product	Versions
ThinkCMF	ThinkCMF	0 – through 8.0.1

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://hackmd.io/@hieuPenguinnn/thinkcmf-admin-rest-api-missing-authorization third-party-advisory
https://github.com/thinkcmf/cmf-core/blob/v8.0.3/src/lib/Auth.php#L40-L61 technical-description
https://github.com/thinkcmf/cmf-core/blob/v8.0.3/src/controller/RestAdminBaseController.php#L15-L34 technical-description
https://github.com/thinkcmf/cmf-api/blob/v8.0.7/src/admin/controller/RoleController.php#L345-L381 technical-description
VulnCheck Advisory: ThinkCMF through 8.0.1 Incorrect Authorization in Admin REST API third-party-advisory