CVE-2026-116214: MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code
Published Oct 26, 2026
·Updated
MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because checkmsg() never compares msgto. Attackers can request a recovery code to their own mailbox via user/findpassmsg, then submit it to user/findpassreset with the victim's email or phone to take over the account.
Affected Software
1 affected component
maccms MacCMS v10<2026.1000.4054
Event History
Oct 26, 2026
CVE Published
via MITRE·01:08 PM
Data Sourced
via MITRE·01:08 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected, and what version addresses the issue?
MacCMS v10 releases before 2026.1000.4054 are affected. Upgrade to 2026.1000.4054 or a later release.
2
What must an attacker have to exploit this issue?
The attacker does not need an account or user interaction. They need to be able to request a password-recovery code to a mailbox they control and submit that code with the target member's email address or phone number.