CVE-2026-111655: ThinkAdmin think-plugs-admin through 1.0.81 IDOR via admin/file.edit
ThinkAdmin think-plugs-admin through 1.0.81 contains an insecure direct object reference vulnerability that allows non-super administrators to read and overwrite other administrators' file records via admin/file.edit. Attackers holding the admin/file.edit node can request or POST a target id with columns like xurl, hash, or uuid to view download URLs, tamper records, or reassign ownership.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated non-super administrator can exploit it if their account has the admin/file.edit node permission. The attacker must be able to send requests to admin/file.edit and supply the identifier of another administrator's file record.
What can an attacker do with access to a target file record?
They can read download URLs associated with the record and overwrite record fields. Reported fields include xurl, hash, and uuid, and the attacker may tamper with records or reassign their ownership.
Is an unauthenticated or low-privilege user affected?
The available information indicates that exploitation requires high privileges: an authenticated administrator account with the admin/file.edit permission. It does not describe unauthenticated exploitation.
How can administrators reduce exposure before updating?
Restrict the admin/file.edit node to only trusted super administrators or administrators who genuinely require file-record editing. Review accounts currently assigned that node permission and remove it where it is not necessary.