CVE-2026-111352

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-111352

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111352.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-111352

Published

2026-10-15T21:43:42Z

Modified

2026-10-21T02:55:45Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

ThinkCMF through 8.0.1 Incorrect Authorization in Admin REST API

Details

ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check() fails open when no admin_api rule exists. Attackers with a valid admin-type API token can list member emails and mobile numbers, disable members, and call PUT admin/roles/{id}/authorize to grant themselves full administrator rights.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-863"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111352.json"
}

References

Affected packages

Git / github.com/thinkcmf/cmf-api

Affected ranges

Type

GIT

Repo

https://github.com/thinkcmf/cmf-api

Events

Introduced

Last Affected

88e2cc3340184d44788cfe6e8b7e4bcb9c03db67

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "8.0.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "8.0.1"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Affected versions

v5.*

v5.1.0

v5.1.1

v5.1.2

v5.1.3

v5.1.4

v5.1.5

v5.1.6

v6.*

v6.0.0

v6.0.1

v6.0.2

v6.0.3

v6.0.4

v6.0.5

v6.0.6

v6.0.7

v6.0.8

v8.*

v8.0.0

v8.0.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111352.json"