CVE-2026-111655 — ThinkAdmin think-plugs-admin through 1.0.81 IDOR via admin/file.edit
ThinkAdmin think-plugs-admin through 1.0.81 contains an insecure direct object reference vulnerability that allows non-super administrators to read and overwrite other administr…
Published: 2026-10-16 · CVSS: 5.1 · CVSS 4.0
ThinkAdmin think-plugs-admin through 1.0.81 contains an insecure direct object reference vulnerability that allows non-super administrators to read and overwrite other administrators' file records via admin/file.edit. Attackers holding the admin/file.edit node can request or POST a target id with columns like xurl, hash, or uuid to view download URLs, tamper records, or reassign ownership.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7