CVE-2021-40616: Thinkcmf

Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days.

thinkcmf v5.1.7 has an unauthorized vulnerability. The attacker can modify the password of the administrator account with id 1 through the background user management group permissions. The use condition is that the background user management group authority is required.

Affected products

• Thinkcmf Thinkcmf: version 5.1.7 only

Published 2022-06-14. Last modified 2026-06-17.