CVE-2026-111356: MacCMS v10 through 2026.1000.4056 Account Takeover via Password Recovery Brute-Force
MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim's email or phone can request a code and brute-force findpassreset to overwrite the member's password.
Affected Software
Event History
Frequently Asked Questions
Which accounts are exposed to takeover?
Member accounts are exposed when an attacker knows the victim's email address or phone number. The attacker can request a password-recovery code and use it to reset that member's password.
Does exploitation require an existing account or user interaction?
No. The issue can be exploited by an unauthenticated attacker and does not require user interaction, although the attacker needs the target member's email address or phone number.
What condition makes brute-forcing the recovery code possible?
The password-recovery flow uses a six-digit code and does not limit attempts to submit that code to findpass_reset. This allows repeated guesses until a valid code is found.