CVE-2026-111352: ThinkCMF through 8.0.1 Incorrect Authorization in Admin REST API
ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check() fails open when no adminapi rule exists. Attackers with a valid admin-type API token can list member emails and mobile numbers, disable members, and call PUT admin/roles/{id}/authorize to grant themselves full administrator rights.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need before exploiting this issue?
The attacker needs a valid admin-type API token. A restricted backend administrator with such a token can exploit the authorization failure.
Under what condition does the authorization check fail open?
The failure occurs when no admin_api rule exists for an admin REST API endpoint. In that situation, Auth::check() allows access instead of denying it.
What is the likely impact after successful exploitation?
An attacker can access member email addresses and mobile numbers, disable members, and use the role authorization endpoint to grant themselves full administrator privileges.