CVE-2026-111352

8.8High

Published 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

8.8High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-863

Impact

Low-privileged administrators can escalate privileges to full admin, extract member emails and phone numbers, or disable accounts via REST API calls. An attacker needs valid network access and an existing admin-type API token with restricted permissions.

Root cause

RestAdminBaseController fails open during authorization checks when no admin_api rule is defined for a requested endpoint in Auth::check().

Affected systems

ThinkCMF through 8.0.1

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade ThinkCMF components to a version above 8.0.1 once released. If patching immediately is not possible, restrict network access to the admin REST API endpoints or revoke unnecessary admin API tokens.

shell

$ composer update thinkcmf/cmf-core thinkcmf/cmf-api

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check() fails open when no admin_api rule exists. Attackers with a valid admin-type API token can list member emails and mobile numbers, disable members, and call PUT admin/roles/{id}/authorize to grant themselves full administrator rights.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-111352