ThinkAdmin think-plugs-admin versions up to 1.0.81 contain an insecure direct object reference vulnerability that allows a non‑super administrator to read and overwrite other administrators’ file records through the admin/file.edit controller. A privileged attacker can submit a target record id and request columns such as xurl, hash, or uuid, thereby exposing download URLs, modifying record data, or reassigning ownership. This behavior maps to CWE‑639.

Affected product is ZouJingLi’s ThinkPlugsAdmin (think-plugs-admin), with all releases up to and including version 1.0.81 vulnerable. No specific sub‑versions were listed, so any build within that range is impacted.

The CVSS score is 5.1, indicating a moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits at the time of the advisory. Exploitation requires the attacker to possess the admin/file.edit RBAC permission, which is typical of an authenticated internal attacker; therefore the attack vector is likely restricted to users with elevated privileges rather than through the public web interface.