Is CVE-2026-111655 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-111655?

CVE-2026-111655 has a CVSS v3 severity of LOW (3.8).

Back

CVE-2026-111655

Description

ThinkAdmin think-plugs-admin through 1.0.81 contains an insecure direct object reference vulnerability that allows non-super administrators to read and overwrite other administrators' file records via admin/file.edit. Attackers holding the admin/file.edit node can request or POST a target id with columns like xurl, hash, or uuid to view download URLs, tamper records, or reassign ownership.