Threats affecting pkg:composer/ThinkCMF

ThinkCMF versions up to 8.0.1 have an incorrect authorization vulnerability in the RestAdminBaseController. This flaw allows backend administrators with restricted privileges to bypass authorization checks because Auth::check() fails open when no admin_api rule is defined. Attackers possessing a valid admin-type API token can exploit this to access all admin REST API endpoints, including listing member emails and mobile numbers, disabling members, and elevating their privileges to full administrator rights.