All vulnerabilities
CVE-2026-116214

maccms10: MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code

maccmspro maccms10
Open in ThreatlineRecord JSON
CVSS
9.3Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in2026.1000.4054Fixed versionCVE List
Published26 Oct 2026Updated 26 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account.

Text from CVE List

Affected versions 2

  • maccms10affected: all versions through 2021.1000.2000CVE List
  • maccms10affected: all versions before 2026.1000.4054CVE List

References 5