CVE-2026-111655ThinkAdmin think-plugs-admin through 1.0.81 IDOR via admin/file.edit
Updated under an hour ago ()
Does this affect you?
It affects zoujingli think-plugs-admin. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
ThinkAdmin think-plugs-admin through 1.0.81 contains an insecure direct object reference vulnerability that allows non-super administrators to read and overwrite other administrators' file records via admin/file.edit. Attackers holding the admin/file.edit node can request or POST a target id with columns like xurl, hash, or uuid to view download URLs, tamper records, or reassign ownership.
- CVSS
- 3.8 LOW (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
- Weakness (CWE)
- CWE-639
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- VulnCheck
- NVD analysis
- Deferred
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 16, 2026
Affected products
zoujingli think-plugs-admin zoujingli:think_plugs_admin (from the name) | through 1.0.81 | CNA record |
References
- https://hackmd.io/@hieuPenguinnn/thinkadmin-file-edit-missing-owner-scope-idorthird-party-advisory
- https://github.com/zoujingli/think-plugs-admin/blob/v1.0.81/src/controller/File.php#L52-L82technical-description
- https://github.com/zoujingli/ThinkLibrary/blob/v6.1.101/src/helper/FormHelper.php#L51-L86technical-description
- https://github.com/zoujingli/ThinkLibrary/blob/v6.1.101/src/service/SystemService.php#L206-L222technical-description
- https://www.vulncheck.com/advisories/thinkadmin-think-plugs-admin-through-1.0.81-idor-via-admin-file-editthird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.