CVE-2026-4563: MacCMS Member Order Detail User.php order_info authorization
A weakness has been identified in MacCMS up to 2025.1000.4052. This vulnerability affects the function orderinfo of the file application/index/controller/User.php of the component Member Order Detail Interface. This manipulation of the argument orderid causes authorization bypass. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4563?
CVE-2026-4563 has been rated with a medium severity level due to its impact on user authorization.
How do I fix CVE-2026-4563?
To fix CVE-2026-4563, update your MacCMS to a version later than 2025.1000.4052.
Which versions of MacCMS are affected by CVE-2026-4563?
CVE-2026-4563 affects all versions of MacCMS up to and including 2025.1000.4052.
What kind of attacks can CVE-2026-4563 lead to?
CVE-2026-4563 can lead to unauthorized access to sensitive user order information.
Who should be concerned about CVE-2026-4563?
All users and administrators of MacCMS versions up to 2025.1000.4052 should be concerned about CVE-2026-4563.