All vulnerabilities
CVE-2026-116216

maccms10: MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment

maccmspro maccms10
Open in ThreatlineRecord JSON
CVSS
6.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published26 Oct 2026Updated 26 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData() that allows unauthenticated attackers to set arbitrary mac_comment columns including user_id. Attackers can submit anonymous comments with a crafted user_id parameter to attribute them to any registered member, displaying that member's avatar and impersonating them.

Text from CVE List

Affected versions 2

  • maccms10affected: all versions through 2021.1000.2000CVE List
  • maccms10affected: all versions through 2026.1000.4056CVE List

References 4