CVE-2026-111352 is a High severity (CVSS 8.8) incorrect authorization flaw in ThinkCMF through 8.0.1. The admin REST API permission check fails open when no matching rule exists, so restricted admins can call any endpoint. We could not confirm a fixed version.
What's affected
The record says ThinkCMF through 8.0.1 is affected. The researcher write-up says ThinkCMF 8.0.0 and 8.0.1 as shipped were reviewed, and names the thinkcmf cmf-core, cmf-api and cmf-install packages. We found no fixed release, so check the thinkcmf repositories for one.
The weakness is CWE-863, incorrect authorization. Per the write-up, every admin REST controller extends RestAdminBaseController, which requires an admin-type account and then checks a rule named with an admin_api prefix. The rule lookup returns true when no matching row exists. The default install seeds no such rules, so the check passes for everyone who is an admin-type user.
The record says an attacker with a valid admin-type API token can list member emails and mobile numbers, disable members, and call the role authorization endpoint to grant themselves full administrator rights. Severity differs by source. The record gives 8.8 (High), and VulnCheck lists 8.7 on a CVSS 4.0 vector. Both are High.
How to check if you're exposed
Check your ThinkCMF version in the Composer lock file.
composer show thinkcmf/cmf-core
Versions in the 8.0 line through 8.0.1 are in range per the record. Then look at your database. Check the auth_rule table for rules with the admin_api prefix. If there are none, the check allows everything, as the write-up describes.
Review which accounts are admin-type, and which of those you consider restricted. Those are the accounts with unintended power. Look at the role tables for recent changes that you did not make. The free in-browser dependency scan at gold.safeguard.sh/scan can match a manifest or lockfile against known CVEs without installing anything.
What to do now
- Check the project for a fixed release and upgrade after you confirm it.
- Until then, add explicit admin_api rules for every REST endpoint you use, so the check has something to deny against.
- Review admin-type accounts and API tokens, and revoke any that are not needed.
- Put the admin API behind a network allow list or VPN.
- Review roles and member records for changes you did not make, and rotate tokens if you suspect misuse.
Why it matters
Authorization that fails open is a design flaw: when the system cannot find a rule, it says yes. The safer default is to deny when a rule is missing, so a forgotten entry causes a visible error, and not a silent grant.
The result is that role restrictions on the admin API do nothing for the default install. A support admin, who should see only some data, can read all members and promote themselves. The record does not mark this CVE as known exploited, and none of the pages we read say it is.
Quick check
What does fail open mean here?
When no matching permission rule exists, the check returns success without looking at the caller's roles.
Who is affected?
Installations of ThinkCMF 8.0.x through 8.0.1 that use restricted backend admin accounts and the admin REST API.
Sources
Last reviewed: 18 October 2026.
