CVE-2026-111352
ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administr
CVSS
8.8
Alta
EPSS
0.5%
p40
KEV
—
Exploit Today
12
0-100
Publicado: 15 de out. de 2026 · Última mod.: 23 de out. de 2026 · CWE-863
0.4%EPSS · 30 dias0.5%
2026-10-162026-11-06
ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check() fails open when no admin_api rule exists. Attackers with a valid admin-type API token can list member emails and mobile numbers, disable members, and call PUT admin/roles/{id}/authorize to grant themselves full administrator rights.
- github.comhttps://github.com/thinkcmf/cmf-api/blob/v8.0.7/src/admin/controller/RoleController.php#L345-L381
- github.comhttps://github.com/thinkcmf/cmf-core/blob/v8.0.3/src/controller/RestAdminBaseController.php#L15-L34
- github.comhttps://github.com/thinkcmf/cmf-core/blob/v8.0.3/src/lib/Auth.php#L40-L61
- hackmd.iohttps://hackmd.io/@hieuPenguinnn/thinkcmf-admin-rest-api-missing-authorization
- www.vulncheck.comhttps://www.vulncheck.com/advisories/thinkcmf-through-8.0.1-incorrect-authorization-in-admin-rest-api
- hackmd.iohttps://hackmd.io/@hieuPenguinnn/thinkcmf-admin-rest-api-missing-authorization
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-186894.3 MÉD—
———IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accepted where it should not be, which could reveal the names of other organizations.6hCVE-2026-173787.7 ALT—
———IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.6hCVE-2026-173737.7 ALT—
———IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.6hCVE-2026-173438.1 ALT—
———IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass authorization checks to access or modify sensitive information due to improper authorization.6hCVE-2026-167115.3 MÉD—
———IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to inject platform credentials into outbound requests due to improper input validation. A validation check is not sufficiently strict, which could cause platform credentials to be included in outbound requests.6hCVE-2026-1232189.8 CRÍ—
———IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.7h