ThinkCMF CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH ThinkCMF CVE published 2026-10-15

CVE-2026-111352

CVE-2026-111352 ThinkCMF Incorrect Authorization in Admin REST API. The vulnerability allows restricted backend administrators with a valid admin-type API token to list member emails and mobile numbers, disable members, and grant themselves full administrator rights. Defenders should assess exposure and prioritize remediation to prevent unauthorized access and unintended changes. The CVE record and source [truncated]