CVE-2026-111655 zoujingli CVE debrief

Who should care

Defenders responsible for ThinkAdmin installations, especially those using the think-plugs-admin plugin, should be aware of this vulnerability. They should verify if their systems are affected and take appropriate actions to mitigate the risk. System administrators and security teams should assess the exposure of the admin/file.edit endpoint and restrict access to super administrators only.

Why it matters

CVE-2026-111655 is a medium-severity vulnerability in ThinkAdmin think-plugs-admin that allows non-super administrators to read and overwrite file records. Defenders should verify exposure, restrict access to the admin/file.edit endpoint, and monitor for suspicious activity. The vulnerability's impact is limited to systems where non-super administrators have access to the admin/file.edit node.

• Potential unauthorized access to sensitive file records
• Possible tampering of file records by non-super administrators
• Exposure of download URLs for sensitive files
• Reassignment of file ownership by attackers

Technical summary

The ThinkAdmin think-plugs-admin plugin through version 1.0.81 contains an insecure direct object reference (IDOR) vulnerability in the admin/file.edit endpoint. This allows non-super administrators to read and overwrite other administrators' file records by manipulating the target ID in the request. The vulnerability is caused by insufficient access control checks in the File controller. Affected product deployments should verify exposure of the admin/file.edit endpoint, especially in systems where non-super administrators have access to this functionality. Defenders should assess the impact of potential file record tampering or unauthorized access to download URLs and restrict access to the admin/file.edit

Defensive priority

Defenders should prioritize verifying exposure of the admin/file.edit endpoint, especially in systems where non-super administrators have access to this functionality. They should also assess the impact of potential file record tampering or unauthorized access to download URLs.

Recommended defensive actions

• Verify exposure of the admin/file.edit endpoint in your environment
• Assess the impact of potential file record tampering or unauthorized access to download URLs
• Restrict access to the admin/file.edit node to super administrators only
• Monitor for suspicious activity related to file record modifications or unauthorized access
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details about the vulnerability, including its description, affected versions, and references to technical descriptions and advisories. However, the corpus does not provide information on exploitation or specific victims.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.