CVE-2026-111352
CVE-2026-111352 · ThinkCMF through 8.0.1 Incorrect Authorization in Admin REST API
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check() fails open when no admin_api rule exists. Attackers with a valid admin-type API token can list member emails and mobile numbers, disable members, and call PUT admin/roles/{id}/authorize to grant themselves full administrator rights.
CVSS 8.7 · Hoch · EPSS 0,5%
- Veröffentlicht
- Aktualisiert
Betroffene Produkte und Versionen
thinkcmf
- Softwareversionen
- ≥ 0, ≤ 8.0.1: Betroffen (semver)
Keine Korrektur veröffentlicht
Originalquellen
- https://hackmd.io/@hieuPenguinnn/thinkcmf-admin-rest-api-missing-authorization
- https://github.com/thinkcmf/cmf-core/blob/v8.0.3/src/lib/Auth.php#L40-L61
- https://github.com/thinkcmf/cmf-core/blob/v8.0.3/src/controller/RestAdminBaseController.php#L15-L34
- https://github.com/thinkcmf/cmf-api/blob/v8.0.7/src/admin/controller/RoleController.php#L345-L381
- https://www.vulncheck.com/advisories/thinkcmf-through-8.0.1-incorrect-authorization-in-admin-rest-api
- https://nvd.nist.gov/vuln/detail/CVE-2026-111352