MacCMS: Account takeover via brute-force of password reset code

Summary

MacCMS v10 through 2026.1000.4056 does not limit the number of attempts on the six-digit password recovery code. An unauthenticated attacker who knows a member's email address or phone number can request a code and brute-force the findpass_reset function to overwrite the member's password and take over the account. The attack is remote and requires no login, but the attacker must know the victim's contact details and needs time to try the codes.

Affected

• magicblack MacCMS v10, all versions up to and including 2026.1000.4056
• Component: password recovery function findpass_reset

Fixed in

Unknown. No fixed version has been published that we could identify. Any fix must be in a release later than 2026.1000.4056.

Workaround

• Disable member password recovery if it is not needed.
• Apply rate limiting and temporary lockouts to the reset endpoint and reset code submissions at the reverse proxy or WAF (our own recommendation, not vendor guidance).
• Keep reset codes short-lived and single-use, if the application allows configuration.

Exploitation

• Exploited in the wild: no evidence found.
• Public proof of concept: a public write-up exists; its content has not been verified.
• CISA SSVC: exploitation status poc, not automatable.
• EPSS 0.00448 (low).

Our recommendation

• Check whether your MacCMS instance is internet-facing and has member accounts; if so, treat this as high priority.
• Disable password recovery or add rate limiting and lockouts on the reset endpoint until a fixed version is available.
• Monitor logs for bursts of reset requests and password changes, and notify affected members if unexplained activity appears.
• Keep administrator accounts on separate credentials and enable MFA where possible.
• Review the whole installation, as related issues (CVE-2026-116215, CVE-2026-116216) were reported in the same product.
• Recheck the magicblack repository and NVD for a fixed version before closing this ticket.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• VulnCheck advisory www.vulncheck.com
• MacCMS GitHub repository github.com
• Affected code User.php (v2026.1000.4056) github.com
• Public write-up (HackMD) hackmd.io
• VulDB entry 420991 vuldb.com
• VulnCheck Vulnrichment record vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:27.