Description
MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| maccmspro | maccms10 | ≤ 2021.1000.2000 | — |
| magicblack | maccms10 | < 2026.1000.4054 | 2026.1000.4054 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
zapstiko/CVE-2026-116214 ★ 1 · Nov 6, 2026
CVE-2026-116214: unauthenticated account takeover in MacCMS v10 via an unbound password-recovery code. Full technical writeup + self-contained Docker lab (maccms10 2021.1000.2000, PHP 7.4, MariaDB, M…
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- GitHub Issue #30 issue-tracking
- https://github.com/maccmspro/maccms10/blob/7f388ee0008faf5b01e5df7bf5e5a6ff4bbe13e8/application/common/model/User.php#L607-L630 technical-description
- Fix Commit (magicblack/maccms10) patch
- https://github.com/maccmspro/maccms10 product
- VulnCheck Advisory: MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code third-party-advisory