{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3athinkcmfthinkcmf/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:thinkcmf:thinkcmf:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-111352"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ThinkCMF (\u003c= 8.0.1)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","privilege-escalation","web"],"_cs_type":"advisory","_cs_vendors":["ThinkCMF"],"content_html":"\u003cp\u003eThinkCMF versions through 8.0.1 are vulnerable to an incorrect authorization flaw located within the RestAdminBaseController. The vulnerability originates from the Auth::check() function, which fails to enforce access control when no explicit 'admin_api' rule is defined for a given endpoint. This failure results in an open state, granting access to restricted REST API endpoints to any user possessing a valid admin-type API token.\u003c/p\u003e\n\u003cp\u003eAn attacker with low-level administrative credentials can exploit this misconfiguration to interact with restricted API methods. This scope includes the ability to exfiltrate sensitive member data, such as email addresses and mobile numbers, the ability to disable user accounts, and the critical capability to invoke the PUT admin/roles/{id}/authorize endpoint to escalate their own account privileges to full administrator. This vulnerability poses a significant risk to the integrity and confidentiality of the ThinkCMF management environment.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains access to a low-privilege administrative API token via credential compromise or insider access.\u003c/li\u003e\n\u003cli\u003eAttacker inspects application API endpoints to identify routes handled by RestAdminBaseController.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious HTTP PUT request directed at the /admin/roles/{id}/authorize endpoint.\u003c/li\u003e\n\u003cli\u003eThe application triggers RestAdminBaseController which calls the flawed Auth::check() function.\u003c/li\u003e\n\u003cli\u003eAuth::check() fails to validate the request because no specific 'admin_api' rule is present, bypassing the permission check.\u003c/li\u003e\n\u003cli\u003eThe application processes the request, granting the attacker's target account full administrative permissions.\u003c/li\u003e\n\u003cli\u003eAttacker logs in with the elevated account to perform full administrative management or data exfiltration.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-111352 allows unauthorized users to perform sensitive administrative actions. This includes unauthorized access to user databases (emails, mobile numbers), disruption of service through account disabling, and full privilege escalation to the super-administrator level, which can result in a total compromise of the application and underlying data.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor web server logs for high-frequency or unauthorized calls to /admin/roles/{id}/authorize or endpoints returning sensitive user metadata.\u003c/li\u003e\n\u003cli\u003eAudit current administrative API permissions and ensure all custom endpoints have explicit 'admin_api' rules defined within the controller logic.\u003c/li\u003e\n\u003cli\u003eEvaluate the necessity of all active admin-type API tokens and revoke those associated with compromised or inactive accounts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-15T22:50:19Z","date_published":"2026-10-15T22:50:19Z","id":"https://feed.craftedsignal.io/briefs/2026-10-thinkcmf-auth-bypass/","summary":"An incorrect authorization flaw in ThinkCMF RestAdminBaseController allows restricted administrators to bypass access controls, leading to privilege escalation and unauthorized data access.","title":"Incorrect Authorization Vulnerability in ThinkCMF RestAdminBaseController","url":"https://feed.craftedsignal.io/briefs/2026-10-thinkcmf-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:thinkcmf:thinkcmf:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}