CVE-2026-116214

CRITICAL 9.1

MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code

CVSS Score

9.1

EPSS Score

0.0%

EPSS Percentile

0th

MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account.

CWE	CWE-640
Vendor	maccmspro
Product	maccms10
Published	Oct 26, 2026

Stay Ahead of the Next One

Get instant alerts for maccmspro maccms10

Be the first to know when new critical vulnerabilities affecting maccmspro maccms10 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

maccmspro / maccms10

0 ≤ 2021.1000.2000

magicblack / maccms10

0 < 2026.1000.4054

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/maccmspro/maccms10/issues/30 github.com: https://github.com/maccmspro/maccms10/blob/7f388ee0008faf5b01e5df7bf5e5a6ff4bbe13e8/application/common/model/User.php#L607-L630 github.com: https://github.com/magicblack/maccms10/commit/27bb1b004b9931c93f46b65e9c0e531466e7e02a github.com: https://github.com/maccmspro/maccms10 vulncheck.com: https://www.vulncheck.com/advisories/maccms-v10-before-2026.1000.4054-account-takeover-via-unbound-password-recovery-code

Credits

Abu Raihan Biswas