Thinkcmf Through 8.0.1 Incorrect Authorization In Admin Rest Api

Back www.vulncheck.com

Thinkcmf Through 8.0.1 Incorrect Authorization In Admin Rest Api

www.vulncheck.com • October 16, 2026

Share: View original

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

High-Risk Authorization Flaw in ThinkCMF Admin API Exposed ThinkCMF versions 8.0.0 and 8.0.1 contain an incorrect authorization vulnerability (CVE-2026-111352) in the RestAdminBaseController. This flaw allows low-privilege backend administrators to access all admin REST API endpoints due to a fail-open condition in the authorization check. Attackers with valid admin API tokens can exploit this to list sensitive member information, disable accounts, and escalate privileges to full administrative rights. The vulnerability affects internet-accessible deployments of ThinkCMF, particularly those with improperly managed admin API tokens. As of now, the exploitation status remains unconfirmed, and no proof-of-concept code has been reported. Immediate remediation is advised, including upgrading to a fixed release and restricting access to the admin API until patched. 1 sources 71

Extracted Entities

CWE Weaknesses (1)

CWE-287 - Improper Authentication