Think Plugs Admin
Monthly
An insecure direct object reference (IDOR) in the ThinkAdmin 'think-plugs-admin' plugin, versions through 1.0.81, allows an authenticated administrator who holds the admin/file.edit permission node - but who is not a super administrator - to read and overwrite other administrators' file records. By requesting or POSTing a target record id together with columns such as xurl, hash, or uuid, the attacker can disclose download URLs, tamper with stored file metadata, or reassign ownership of records belonging to other admins. Exploitation requires a valid privileged admin session and a deployment with multiple administrators, and there is no public exploit code identified at time of analysis and no CISA KEV listing, so real-world risk is a bounded, medium-severity authorization flaw (CWE-639) rather than a systemic compromise path.
An insecure direct object reference (IDOR) in the ThinkAdmin 'think-plugs-admin' plugin, versions through 1.0.81, allows an authenticated administrator who holds the admin/file.edit permission node - but who is not a super administrator - to read and overwrite other administrators' file records. By requesting or POSTing a target record id together with columns such as xurl, hash, or uuid, the attacker can disclose download URLs, tamper with stored file metadata, or reassign ownership of records belonging to other admins. Exploitation requires a valid privileged admin session and a deployment with multiple administrators, and there is no public exploit code identified at time of analysis and no CISA KEV listing, so real-world risk is a bounded, medium-severity authorization flaw (CWE-639) rather than a systemic compromise path.