Vulnerability details
CVE-2026-116214
maccms_pro maccms10magicblack MacCMS10
MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code
CVSS 4.0
9.3Critical
Official description
MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.3Critical | 4.0 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
| 9.1Critical | 3.1 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| maccms_pro | maccms10 | v ≤ 2021.1000.2000 | CVEProject cvelistV5 (CNA) |
| magicblack | MacCMS10 | v < 2026.1000.4054 | CVEProject cvelistV5 (CNA) |
References and advisories
5- https://github.com/maccmspro/maccms10/issues/30 issue-tracking
- https://github.com/maccmspro/maccms10/blob/7f388ee0008faf5b01e5df7bf5e5a6ff4bbe13e8/application/common/model/User.php#L607-L630 technical-description
- https://github.com/magicblack/maccms10/commit/27bb1b004b9931c93f46b65e9c0e531466e7e02a patch
- https://github.com/maccmspro/maccms10 product
- https://www.vulncheck.com/advisories/maccms-v10-before-2026.1000.4054-account-takeover-via-unbound-password-recovery-code third-party-advisory
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-10-26
- Last updated
- 2026-11-05
- State
- Published
- Assigner (CNA)
- VulnCheck
- Kolun priority
- 24 · Low
Exploit prediction (EPSS)
0.45%
Probability of exploitation in 30 days
39.8%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-640Weak Password Recovery Mechanism for Forgotten Password