{"id":"CVE-2026-116214","kind":"vulnerability","aliases":["CVE-2026-116214"],"related":[],"title":"MacCMS v10: unauthenticated password reset lets attackers take over member accounts","description":"MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account.","summary":"MacCMS v10 before 2026.1000.4054 fails to check that a password recovery code was sent to the account's own mailbox, because check_msg() never compares msg_to. An unauthenticated attacker can request a code to their own address and use it to reset any member's password.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["maccms","other","php","self-hosted"],"not_affected_if":["already-on-2026.1000.4054-or-later"],"how_to_check":"- Check the installed MacCMS version against `2026.1000.4054` in the admin panel or release files\n- Review web server logs for requests to `user/findpass_msg` and `user/findpass_reset` from unknown sources\n- unknown for other configuration details","fix":"- Upgrade MacCMS v10 to `2026.1000.4054` or later\n- Rotate member passwords and review accounts changed recently if the site was exposed before the upgrade","status":"open","published_at":"2026-10-26T14:16:34+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","triaged_at":"2026-10-26T14:32:03+00:00","updated_at":"2026-10-26T14:32:03+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-26T14:32:03Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade MacCMS v10 to `2026.1000.4054` or later\n- Rotate member passwords and review accounts changed recently if the site was exposed before the upgrade","reach":"internet","title":"MacCMS v10: unauthenticated password reset lets attackers take over member accounts","impact":"high","summary":"MacCMS v10 before 2026.1000.4054 fails to check that a password recovery code was sent to the account's own mailbox, because check_msg() never compares msg_to. An unauthenticated attacker can request a code to their own address and use it to reset any member's password.","category":"other","nicknames":[],"who_cares":["maccms","php","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker takes over any member account without credentials","analyst_note":"Check the NVD entry and the vendor's release notes for the fixed version and any configuration conditions; confirm the affected route paths.","how_to_check":"- Check the installed MacCMS version against `2026.1000.4054` in the admin panel or release files\n- Review web server logs for requests to `user/findpass_msg` and `user/findpass_reset` from unknown sources\n- unknown for other configuration details","needs_analyst":true,"not_affected_if":["already-on-2026.1000.4054-or-later"],"who_is_affected":"Sites running MacCMS v10 earlier than `2026.1000.4054` with member accounts and the password recovery flow reachable from the internet. The sources do not say whether the flaw depends on any specific setting, so treat any exposed MacCMS v10 install as in scope.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000629,"input_tokens":3345,"output_tokens":589,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-116214':14A,17A '-2026':13A,16A '2026.1000.4054':27B,74C 'account':11A,40B,125C 'address':61B 'allow':81C 'attack':7A,53B,83C,97C 'authent':77C 'bypass':78C 'check':30B,45B,91C 'code':35B,57B,102C 'compar':48B,94C 'contain':75C 'cve':12A,15A 'email':118C 'fail':28B 'host':23B 'let':6A 'maccm':1A,18B,24B,71C 'mailbox':43B,106C 'member':10A,68B,87C 'msg':46B,49B,92C,95C 'never':47B,93C 'password':4A,33B,70B,89C 'phone':120C 'php':20B 'recoveri':34B,101C 'request':55B,99C 'reset':5A,66B,85C 'self':22B 'self-host':21B 'sent':37B 'submit':110C 'take':8A,122C 'unauthent':3A,52B,82C 'use':63B 'user/findpass_msg':108C 'user/findpass_reset':113C 'v10':2A,25B,72C 'via':107C 'victim':116C 'vulner':79C","nicknames":[],"mitigations":[],"who_affected":"Sites running MacCMS v10 earlier than `2026.1000.4054` with member accounts and the password recovery flow reachable from the internet. The sources do not say whether the flaw depends on any specific setting, so treat any exposed MacCMS v10 install as in scope.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T14:16:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116214","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116214","severity":null,"published_at":"2026-10-26T14:16:34+00:00","modified_at":"2026-10-26T14:16:34+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","fetched_at":"2026-10-26T14:30:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}