CVE-2026-116214
MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 2026.1000.4054
- Public exploit
- None on Exploit-DB
Summary
MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account.
Affected versions
- maccmspro maccms10
through 2021.1000.2000
- magicblack maccms10
fixed in 2026.1000.4054