Live › vulnerability › CVE-2026-116215
Go to dashboardMacCMS v10 through 2026.1000.4056 has a race condition in Card::useData() that lets a logged-in member redeem one recharge card many times by sending concurrent requests to the user/buy endpoint. An attacker gets inflated points that buy VIP upgrades and paid content without paying.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 14:30 UTC. All times on this page are UTC.
Sites running MacCMS v10 through 2026.1000.4056 that sell recharge cards and let members buy VIP or paid content with points. Sites that do not issue recharge cards, or that run a later version, are not described by the sources. unknown for anything beyond that.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint. Attackers can send many concurrent flag=card requests that pass the non-locking card read before it is marked used, inflating user_points to buy VIP upgrades and paid content.
This page as .md · .json · in your agent: get_signal("CVE-2026-116215")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.