CVE-2026-116215: MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption

Q: Can an unauthenticated attacker exploit this issue?

No. Exploitation requires a low-privileged authenticated member account.

Q: Does exploitation require a victim to perform any action?

No. The CVSS vector indicates no user interaction is required.

Q: What is required for the race condition to succeed?

The attacker must send many concurrent card redemption requests using flag=card to the user/buy endpoint before the card is marked as used.

Published Oct 26, 2026

Updated

MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint. Attackers can send many concurrent flag=card requests that pass the non-locking card read before it is marked used, inflating userpoints to buy VIP upgrades and paid content.

Affected Software

1 affected component

maccms Maccms>=v10<=2026.1000.4056

Event History

Oct 26, 2026

CVE Published

via MITRE·01:08 PM

Data Sourced

via MITRE·01:08 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Can an unauthenticated attacker exploit this issue?

No. Exploitation requires a low-privileged authenticated member account.

Does exploitation require a victim to perform any action?

No. The CVSS vector indicates no user interaction is required.

What is required for the race condition to succeed?

The attacker must send many concurrent card redemption requests using flag=card to the user/buy endpoint before the card is marked as used.

CVE-2026-116215: MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption

Affected Software

Event History

Frequently Asked Questions

Can an unauthenticated attacker exploit this issue?

Does exploitation require a victim to perform any action?

What is required for the race condition to succeed?

Company

Resources

Contact

Frequently Asked Questions

Can an unauthenticated attacker exploit this issue?

Does exploitation require a victim to perform any action?

What is required for the race condition to succeed?