CVE-2026-111352
highThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every…
ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check() fails open when no admin_api rule exists. Attackers with a valid admin-type API token can list member emails and mobile numbers, disable members, and call PUT admin/roles/{id}/authorize to grant themselves full administrator rights.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/thinkcmf/cmf-api/blob/v8.0.7/src/admin/controller/RoleController.php#L3... disclosure@vulncheck.com
- https://github.com/thinkcmf/cmf-core/blob/v8.0.3/src/controller/RestAdminBaseController.ph... disclosure@vulncheck.com
- https://github.com/thinkcmf/cmf-core/blob/v8.0.3/src/lib/Auth.php#L40-L61 disclosure@vulncheck.com
- https://hackmd.io/@hieuPenguinnn/thinkcmf-admin-rest-api-missing-authorization disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/thinkcmf-through-8.0.1-incorrect-authorization-in-adm... disclosure@vulncheck.com
- https://hackmd.io/@hieuPenguinnn/thinkcmf-admin-rest-api-missing-authorization 134c704f-9b21-4f2e-91b3-4a467353bcc0