EUVD-2026-102496

ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check fails open when no adminapi rule exists. Attackers with a valid admin-type API token can list...

CVE-2026-111352

ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check fails open when no adminapi rule exists. Attackers with a valid admin-type API token can list...

CVE-2026-111352 ThinkCMF through 8.0.1 Incorrect Authorization in Admin REST API

ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check fails open when no adminapi rule exists. Attackers with a valid admin-type API token can list...

CVE-2026-111352 ThinkCMF through 8.0.1 Incorrect Authorization in Admin REST API

ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check fails open when no adminapi rule exists. Attackers with a valid admin-type API token can list...

CVE-2026-111352

ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check fails open when no adminapi rule exists. Attackers with a valid admin-type API token can list...

CVE-2026-111352

ThinkCMF versions through 8.0.1 are vulnerable to an incorrect authorization flaw in the RestAdminBaseController. The root cause is that Auth::check() fails open when no admin_api rule is defined, allowing restricted backend administrators to access all admin REST API endpoints. An attacker posse...

CVE-2026-111352 ThinkCMF through 8.0.1 Incorrect Authorization in Admin REST API

ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check fails open when no adminapi rule exists. Attackers with a valid admin-type API token can list...

CVE-2026-111352: Incorrect Authorization

ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check fails open when no adminapi rule exists. Attackers with a valid admin-type API token can list...

PT-2026-115296

ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check fails open when no admin api rule exists. Attackers with a valid admin-type API token can lis...

ThinkCMF Authorization Issue Vulnerability

ThinkCMF 8.0.1 and earlier versions have an authorization issue. This vulnerability stems from improper authorization in the RestAdminBaseController. When there are no adminapi rules, the Auth::check validation fails, allowing restricted backend administrators to call all administrator REST API...