CVE-2026-111655 ThinkAdmin think-plugs-admin through 1.0.81 IDOR via admin/file.edit
Non-super administrators can read and modify other administrators' file records via insecure direct object reference in ThinkAdmin.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-111655?
CVE-2026-111655 is a medium-severity missing authorization vulnerability in zoujingli think-plugs-admin, published on 16 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
ThinkAdmin think-plugs-admin through 1.0.81 contains an insecure direct object reference vulnerability that allows non-super administrators to read and overwrite other administrators' file records via admin/file.edit. Attackers holding the admin/file.edit node can request or POST a target id with columns like xurl, hash, or uuid to view download URLs, tamper records, or reassign ownership.
Weakness: CWE-639
Which versions are affected by CVE-2026-111655?
How do I fix CVE-2026-111655?
No fix has been published for CVE-2026-111655 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-111655 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-111655 exists.
Sources
Also known as GHSA-wcpc-prgf-22hq.