Live › vulnerability › CVE-2026-116216
Go to dashboardMacCMS v10 through 2026.1000.4056 accepts a user_id value from the comment submission in index/Comment::saveData(), a mass assignment flaw. An unauthenticated attacker can post comments attributed to any registered member, showing that member's avatar and name.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 14:30 UTC. All times on this page are UTC.
Sites running MacCMS v10 up to and including 2026.1000.4056 with the comment feature in use. The sources do not say whether comments must be enabled or moderated for the flaw to apply, so treat any site with comments on as in scope.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData() that allows unauthenticated attackers to set arbitrary mac_comment columns including user_id. Attackers can submit anonymous comments with a crafted user_id parameter to attribute them to any registered member, displaying that member's avatar and impersonating them.
This page as .md · .json · in your agent: get_signal("CVE-2026-116216")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.