Skip to content
High-Risk Authorization Flaw in ThinkCMF Admin API Exposed

High-Risk Authorization Flaw in ThinkCMF Admin API Exposed

First seen 16 Oct 2026, 05:49 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 16, 2026 at 09:38 UTC
  • •CVE-2026-111352 allows unauthorized access to all admin API endpoints.
  • •Affected versions include ThinkCMF 8.0.0 and 8.0.1, with a CVSS score of 8.7.
  • •Immediate action is required to mitigate risks associated with this vulnerability.

ThinkCMF versions 8.0.0 and 8.0.1 contain an incorrect authorization vulnerability (CVE-2026-111352) in the RestAdminBaseController. This flaw allows low-privilege backend administrators to access all admin REST API endpoints due to a fail-open condition in the authorization check. Attackers with valid admin API tokens can exploit this to list sensitive member information, disable accounts, and escalate privileges to full administrative rights. The vulnerability affects internet-accessible deployments of ThinkCMF, particularly those with improperly managed admin API tokens. As of now, the exploitation status remains unconfirmed, and no proof-of-concept code has been reported. Immediate remediation is advised, including upgrading to a fixed release and restricting access to the admin API until patched.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-15
CVE-2026-111352 published
The vulnerability was officially disclosed with a high CVSS score of 8.7, indicating significant risk.
VulnCheck
2026-10-16
Multiple advisories released
Redpacketsecurity and HackMD published advisories detailing the vulnerability and its implications for affected systems.
Redpacketsecurity

More articles in this cluster (3)

Following this threat?

Track CVE-2026-111352 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (5)

1 / 4

Common questions

Which versions of ThinkCMF are affected?
ThinkCMF versions 8.0.0 and 8.0.1 are affected by this vulnerability.
What actions should be taken immediately?
Upgrade to a vendor-confirmed fixed release and restrict admin API access until the patch is applied.
Is there any confirmed exploitation of this vulnerability?
Currently, the exploitation status is unconfirmed, and no proof-of-concept code has been reported.