CVE-2026-111352CWE-863broken-access-control

CVE-2026-111352

High · published October 16, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
28.7
In the wild
Unconfirmed
What it is

ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check() fails open when no admin_api rule exists. Attackers with a valid admin-type API token can list member emails and mobile numbers, disable members, and call PUT admin/roles/{id}/authorize to grant themselves full administrator rights.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00361 · 28.7th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-10-16T02:19Z
References (6)
https://github.com/thinkcmf/cmf-api/blob/v8.0.7/src/admin/controller/RoleController.php#L345-L381 · [email protected]https://github.com/thinkcmf/cmf-core/blob/v8.0.3/src/controller/RestAdminBaseController.php#L15-L34 · [email protected]https://github.com/thinkcmf/cmf-core/blob/v8.0.3/src/lib/Auth.php#L40-L61 · [email protected]https://hackmd.io/@hieuPenguinnn/thinkcmf-admin-rest-api-missing-authorization · [email protected]https://www.vulncheck.com/advisories/thinkcmf-through-8.0.1-incorrect-authorization-in-admin-rest-api · [email protected]https://hackmd.io/@hieuPenguinnn/thinkcmf-admin-rest-api-missing-authorization · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 17 OCT 03:28Z
    EPSS moved — → 0%
    epss
  • 15 OCT 21:43Z
    ThinkCMF through 8.0.1 Incorrect Authorization in Admin REST API
    cvelistv5
  • 15 OCT 21:43Z
    ThinkCMF through 8.0.1 Incorrect Authorization in Admin REST API
    cvelistv5