think-plugs-admin CVE-2026-111655

Exploitation requires an authenticated administrator account that holds the admin/file.edit permission node but is NOT a super administrator; the attacker then supplies a target record id with columns such as xurl, hash, or uuid to the admin/file.edit endpoint. The flaw exists because File.php (v1.0.81, lines 52-82) performs no owner/scope check binding file records to the requesting admin. Limiting factors: a valid privileged admin session is mandatory (not remote-unauthenticated), the deployment must have multiple administrators for cross-admin abuse to matter, and impact is confined to file-record metadata (download URLs, hashes, ownership) rather than full system compromise.

This is a medium-severity authorization flaw (IDOR, CWE-639) whose real-world risk is moderate and bounded. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N) correctly reflects a network-reachable, low-complexity issue, but every impact metric is Low and there is no availability or scope impact, yielding a base score of 5.1. Critically, exploitation is NOT unauthenticated: the attacker must already hold a valid administrator account carrying the admin/file.edit node (PR is High/Low, not None), so this is a horizontal/privilege-boundary bypass between existing admins rather than an external breach. No EPSS score, no CISA KEV listing, and no explicit POC flag are present in the input, so there is no signal of active or widespread exploitation; a technical write-up (hackmd) and source-line references exist but these document the flaw, not weaponized exploit code. Note a terminology conflict in the input: the 'Authentication Bypass' tag contradicts both CWE-639 and the description, which describe an authorization/IDOR issue abusable only by an already-authenticated non-super admin - verify tagging before using it for detection logic. Net: a legitimate finding to patch in multi-admin ThinkAdmin deployments, but not an emergency given the required privileged foothold and limited Low-impact outcome.

A lower-privileged (non-super) administrator who holds the admin/file.edit node issues a GET or POST to admin/file.edit supplying another administrator's file record id, then reads that record's download URL (xurl), hash, or uuid - or overwrites those columns to tamper with the record or reassign its ownership. No special network conditions or user interaction are needed, but a valid privileged admin session is required; no public exploit code is identified in the provided data, only a technical write-up.