CVE-2026-111356
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim's email or phone can request a code and brute-force findpass_reset to overwrite the member's password.
Risk Assessment
An attacker can take over any member account if they know the victim's email or phone number, leading to unauthorized access and data breaches. The lack of attempt limits enables an effective brute-force attack on the recovery code.
Recommendation
Update MacCMS to a version newer than 2026.1000.4056 if available, or implement attempt limits and account lockout after failed attempts. Consider increasing the complexity of the password recovery code.
Other vulnerabilities in MacCMS
See all- CVE-2026-116214Critical
MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account.
- CVE-2017-17733Critical
Maccms 8.x allows remote command execution via the wd parameter in an index.php?m=vod-search request.
- CVE-2026-116216Medium
MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData() that allows unauthenticated attackers to set arbitrary mac_comment columns including user_id. Attackers can submit anonymous comments with a crafted user_id parameter to attribute them to any registered member, displaying that member's avatar and impersonating them.
- CVE-2026-116215Low
MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint. Attackers can send many concurrent flag=card requests that pass the non-locking card read before it is marked used, inflating user_points to buy VIP upgrades and paid content.
- CVE-2026-75465High
Incorrect Access Control vulnerability in the /api.php/user/get_list endpoint in Maccms v10 v2026.1000.4055. The interface fails to perform any authentication or authorization checks. An unauthenticated remote attacker can send a crafted HTTP GET request with limit and offset parameters to paginate and retrieve sensitive information of all registered users.
Original NVD description (English source)
MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim's email or phone can request a code and brute-force findpass_reset to overwrite the member's password.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS