All vulnerabilities
CVE-2026-116215

maccms10: MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption

maccmspro maccms10
Open in ThreatlineRecord JSON
CVSS
2.3Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published26 Oct 2026Updated 26 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint. Attackers can send many concurrent flag=card requests that pass the non-locking card read before it is marked used, inflating user_points to buy VIP upgrades and paid content.

Text from CVE List

Affected versions 2

  • maccms10affected: all versions through 2021.1000.2000CVE List
  • maccms10affected: all versions through 2026.1000.4056CVE List

References 4