CVE-2026-71625

Published: Sep 4, 2026Modified: Sep 9, 2026Deferred

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An issue in slimkit plus ThinkSNS+ v.2.4 allows a remote attacker to escalate privileges via the ResetPasswordController.php component

Related CWEs

Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Weak Password Recovery Mechanism for Forgotten Password

The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

References (3)

https://colorful-quill-4fe.notion.site/CVE-2026-71625-ThinkSNS-Plus-Account-Takeover-via-Expired-Verification-Code-in-Password-Reset-380e5670300c808bbf82ee8cf8ed25e3?source=copy_link

Source: cve@mitre.org

https://github.com/slimkit/plus

Source: cve@mitre.org

https://colorful-quill-4fe.notion.site/CVE-2026-71625-ThinkSNS-Plus-Account-Takeover-via-Expired-Verification-Code-in-Password-Reset-380e5670300c808bbf82ee8cf8ed25e3

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.