CVE-2026-111352: falha de alta gravidade em ThinkCMF
ThinkCMF through 8.0.1 Incorrect Authorization in Admin REST API
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.7epss 0.5%
ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check() fails open when no admin_api rule exists. Attackers with a valid admin-type API token can list member emails and mobile numbers, disable members, and call PUT admin/roles/{id}/authorize to grant themselves full administrator rights.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
ThinkCMF · ThinkCMFReferências
https://github.com/thinkcmf/cmf-api/blob/v8.0.7/src/admin/controller/RoleController.php#L345-L381https://github.com/thinkcmf/cmf-core/blob/v8.0.3/src/controller/RestAdminBaseController.php#L15-L34https://github.com/thinkcmf/cmf-core/blob/v8.0.3/src/lib/Auth.php#L40-L61https://hackmd.io/@hieuPenguinnn/thinkcmf-admin-rest-api-missing-authorizationhttps://www.vulncheck.com/advisories/thinkcmf-through-8.0.1-incorrect-authorization-in-admin-rest-api