Live › vulnerability › CVE-2026-116214
Go to dashboardMacCMS v10 before 2026.1000.4054 fails to check that a password recovery code was sent to the account's own mailbox, because check_msg() never compares msg_to. An unauthenticated attacker can request a code to their own address and use it to reset any member's password.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 14:30 UTC. All times on this page are UTC.
Sites running MacCMS v10 earlier than 2026.1000.4054 with member accounts and the password recovery flow reachable from the internet. The sources do not say whether the flaw depends on any specific setting, so treat any exposed MacCMS v10 install as in scope.
No product ranges from the sources yet.
2026.1000.4054 in the admin panel or release filesuser/findpass_msg and user/findpass_reset from unknown sources2026.1000.4054 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account.
This page as .md · .json · in your agent: get_signal("CVE-2026-116214")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.