CVE Alert: CVE-2026-111352 – ThinkCMF

ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check() fails open when no admin_api rule exists. Attackers with a valid admin-type API token can list member emails and mobile numbers, disable members, and call PUT admin/roles/{id}/authorize to grant themselves full administrator rights.

**Risk verdict:** High risk: a low-privilege account can potentially gain full administrative control, so prioritise prompt remediation; exploitation status is unconfirmed because KEV, SSVC, PoC and EPSS data are not provided.

**Why this matters:** Successful abuse could expose member details, disrupt accounts and enable unauthorised changes across the application. The likely attacker goal is privilege escalation for persistent control, data access or service disruption.

**Most likely attack path:** An attacker needs a valid, restricted administrator-type API token, but the vulnerable endpoints are network-accessible and require no user interaction or complex conditions. They can use that token to invoke administrative actions and elevate their rights; the stated scope indicates impact remains within the application, though broader consequences depend on connected systems and shared credentials.

**Who is most exposed:** Internet-accessible deployments of this CMS with admin API tokens issued to restricted staff, integrations or service accounts are the most exposed. Internal-only deployments still warrant attention if those tokens can be obtained through another compromise.

Review logs for restricted tokens calling unexpected admin REST endpoints.

Alert on role-authorisation changes, new administrator grants and member disablement.

Investigate bulk member lookups or unusual access to email and mobile-number fields.

Mitigation and prioritisation

Upgrade to a vendor-confirmed fixed release; verify the authorization checks are corrected before closure.

Until patched, restrict admin API access by network and revoke or rotate exposed tokens.

Temporarily disable affected endpoints if safe; test emergency controls and document service impact.

Review recent role changes and token activity for evidence of prior misuse.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.