CVE-2026-71625

CVE-2026-71625 is an unauthenticated privilege-escalation flaw in the ResetPasswordController.php component of ThinkSNS+ v2.4, an open-source PHP (Laravel-based) social networking platform maintained under the slimkit/plus project. A remote attacker can send a malicious request to the forgotten-password/reset flow without any credentials, and the weak password-recovery mechanism (CWE-640) combined with improper privilege management (CWE-640/CWE-269) lets the attacker escalate privileges, most plausibly by taking over another user's account, potentially a higher-privileged one. The CVSS 9.8 (Critical) score reflects network reachability, low attack complexity, and full confidentiality/integrity/availability impact on the affected instance. Users and operators running ThinkSNS+ v2.4 deployments — typically self-hosted community or social platforms — are affected. There is currently no public proof-of-concept, the flaw is not in CISA KEV, and EPSS is just 0.2%, so no confirmed exploitation is known.

What to do: Inventory any deployments running ThinkSNS+ v2.4, since no fixed version is specified in the available data — watch the slimkit/plus repository for a patched release and apply it promptly. As interim mitigation, restrict network access to the application, review reset-password logs and recent account-privilege changes for signs of tampering, and monitor reset requests from unauthenticated sources.