ThinkCMF versions up to 8.0.1 contain an incorrect authorization flaw in RestAdminBaseController that allows a restricted backend administrator to call all admin REST API endpoints. The flaw exists because Auth::check() fails open when no admin_api rule is present, enabling an attacker with a valid admin-type API token to list member emails and mobile numbers, disable members, and grant themselves full administrator rights via the PUT admin/roles/{id}/authorize endpoint.

The vulnerability affects ThinkCMF products through version 8.0.1, including the core framework and admin REST API components. All installations running any 8.0.1 or earlier release are potentially vulnerable.

The CVSS score of 8.7 indicates a high severity, and although the EPSS score indicates a very low exploitation probability (<1%), the lack of a known exploit in KEV does not diminish the risk. Exploitation requires possession of a valid admin API token; once in hand, the attacker can bypass authorization checks entirely because the Auth check function accepts every request that lacks an explicit admin_api rule. The impact ranges from data exposure to complete takeover of administrative privileges, affecting system confidentiality, integrity, and availability beyond the limited scope of the original restricted administrator.