MacCMS v10: Authentication bypass allows account takeover via password reset
Summary
MacCMS v10 before 2026.1000.4054 does not verify that the recovery code used in the password reset belongs to the requesting account. An unauthenticated attacker can request a recovery code to their own mailbox and use it to reset the password of any member, provided they know the victim's email address or phone number. The flaw is network-reachable and requires no user interaction, so any internet-facing MacCMS site is exposed.
Affected
- MacCMS v10 (maccmspro/maccms10): versions up to and including 2021.1000.2000 per VulnCheck record
- MacCMS v10 (magicblack/maccms10): versions before 2026.1000.4054
- Related CVE-2026-111356 affects versions through 2026.1000.4056 (separate issue)
Fixed in
- Upgrade to version 2026.1000.4054 or later
- Confirm the newest release with the vendor, because a related issue is reported up to 2026.1000.4056
Workaround
- No workaround is documented in the CVE record.
- Upgrading is the supported path. If an upgrade is not possible immediately, take the site offline or restrict access to trusted users until it is patched.
Exploitation
- No evidence of exploitation in the wild found; not listed in the CISA KEV catalogue.
- Public proof of concept: conflicting information; VulDB reports no available exploit.
- Exploitation is simple: no authentication, no privileges and no user interaction are required.
Our recommendation
- Check whether any MacCMS v10 instance is in use and which repository it originates from.
- Upgrade to 2026.1000.4054 or later and verify the latest release with the vendor.
- Check for exposed installer functionality described in the vendor issue and remove or restrict it.
- Review password reset logs and notify members if there are signs of misuse.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- MacCMS vendor issue #30 github.com
- Vulnerable code in User.php github.com
- Fix commit (magicblack/maccms10) github.com
- VulDB entry vuldb.com
- MacCMS upstream repository github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:44.
Original description (NVD)
MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account.
NVD references (5)
- https://github.com/maccmspro/maccms10
- https://github.com/maccmspro/maccms10/blob/7f388ee0008faf5b01e5df7bf5e5a6ff4bbe13e8/application/common/model/…
- https://github.com/maccmspro/maccms10/issues/30
- https://github.com/magicblack/maccms10/commit/27bb1b004b9931c93f46b65e9c0e531466e7e02a
- https://www.vulncheck.com/advisories/maccms-v10-before-2026.1000.4054-account-takeover-via-unbound-password-r…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.