CVE-2026-116214: MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-26 · updated 2026-10-26
Weakness: CWE-640

Description

MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account.

Summary

MacCMS v10 before 2026.1000.4054 has an authentication bypass in its password recovery flow: check_msg() never compares msg_to, so a recovery code sent to an attacker's own mailbox is accepted for any account. An unauthenticated attacker can request a code via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account (CVSS 9.1, critical). Affected are magicblack MacCMS10 and maccmspro maccms10 before 2026.1000.4054. It is not in CISA KEV and no in-the-wild exploitation is reported. Upgrade to 2026.1000.4054 or later; if you cannot patch immediately, disable or restrict the user/findpass_msg and user/findpass_reset endpoints.

تحتوي MacCMS v10 قبل الإصدار 2026.1000.4054 على ثغرة تجاوز للمصادقة في مسار استعادة كلمة المرور، إذ لا تقارن الدالة check_msg() القيمة msg_to، لذا يُقبل رمز الاستعادة المُرسل إلى بريد المهاجم لأي حساب. يستطيع مهاجم غير مُصادَق طلب رمز عبر user/findpass_msg ثم إرساله إلى user/findpass_reset مع بريد الضحية أو رقم هاتفه للاستيلاء على الحساب (CVSS 9.1، حرجة). تتأثر magicblack MacCMS10 وmaccmspro maccms10 قبل 2026.1000.4054، ولم تُدرَج في CISA KEV ولم يُبلَّغ عن استغلال فعلي. يُنصح بالترقية إلى 2026.1000.4054 أو أحدث، وعند تعذّر الترقية الفوري يُعطَّل أو يُقيَّد الوصول إلى نقطتي user/findpass_msg وuser/findpass_reset.

Affected products

magicblack MacCMS10: before 2026.1000.4054 — fixed in 2026.1000.4054
maccmspro maccms10: through 2021.1000.2000

How to fix

Upgrade to a fixed version: magicblack MacCMS10 2026.1000.4054. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-116214 or the next vulnerability affects your stack