CyberSecBulletin

ThinkCMF vulnerabilities

We track 2 vulnerabilities in ThinkCMF products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 15, 2026.

2vulnerabilities
0critical
2high
0exploited
8.8average CVSS score

Latest ThinkCMF vulnerabilities

  • 8.8 High severity

    ThinkCMF: Incorrect Authorization

    CVE-2026-111352ThinkCMF

    ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check() fails open when no admin_api rule exists. Attackers wi

  • 8.8 High severity

    Thinkcmf: Cross-Site Request Forgery

    CVE-2022-40489ThinkCMF

    ThinkCMF version 6.0.7 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows a Super Administrator user to be injected into administrative users.