{"id":"CVE-2026-116216","kind":"vulnerability","aliases":["CVE-2026-116216"],"related":[],"title":"MacCMS: comment form lets anonymous visitors post as any member","description":"MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData() that allows unauthenticated attackers to set arbitrary mac_comment columns including user_id. Attackers can submit anonymous comments with a crafted user_id parameter to attribute them to any registered member, displaying that member's avatar and impersonating them.","summary":"MacCMS v10 through 2026.1000.4056 accepts a user_id value from the comment submission in index/Comment::saveData(), a mass assignment flaw. An unauthenticated attacker can post comments attributed to any registered member, showing that member's avatar and name.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["maccms","package","php","self-hosted"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-26T14:16:34+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","triaged_at":"2026-10-26T14:32:29+00:00","updated_at":"2026-10-26T14:32:29+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T14:32:29Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"MacCMS: comment form lets anonymous visitors post as any member","impact":"low","summary":"MacCMS v10 through 2026.1000.4056 accepts a user_id value from the comment submission in index/Comment::saveData(), a mass assignment flaw. An unauthenticated attacker can post comments attributed to any registered member, showing that member's avatar and name.","category":"package","nicknames":[],"who_cares":["maccms","php","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Anonymous users impersonate registered members in site comments","analyst_note":"Check the NVD entry and the MacCMS project for a fixed release and for how to confirm the comment endpoint is exposed.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Sites running MacCMS v10 up to and including 2026.1000.4056 with the comment feature in use. The sources do not say whether comments must be enabled or moderated for the flaw to apply, so treat any site with comments on as in scope.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000548,"input_tokens":3352,"output_tokens":426,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116216':13A,16A '-2026':12A,15A '2026.1000.4056':26B,64C 'accept':27B 'allow':74C 'anonym':5A,89C 'arbitrari':79C 'assign':41B,68C 'attack':45B,76C,86C 'attribut':49B,98C 'avatar':58B,108C 'column':82C 'comment':2A,34B,48B,81C,90C 'contain':65C 'craft':93C 'cve':11A,14A 'display':104C 'flaw':42B 'form':3A 'host':22B 'id':30B,85C,95C 'imperson':110C 'includ':83C 'index/comment':37B,71C 'let':4A 'mac':80C 'maccm':1A,17B,23B,61C 'mass':40B,67C 'member':10A,53B,56B,103C,106C 'name':60B 'packag':18B 'paramet':96C 'php':19B 'post':7A,47B 'regist':52B,102C 'savedata':38B,72C 'self':21B 'self-host':20B 'set':78C 'show':54B 'submiss':35B 'submit':88C 'unauthent':44B,75C 'user':29B,84C,94C 'v10':24B,62C 'valu':31B 'visitor':6A 'vulner':69C","nicknames":[],"mitigations":[],"who_affected":"Sites running MacCMS v10 up to and including 2026.1000.4056 with the comment feature in use. The sources do not say whether comments must be enabled or moderated for the flaw to apply, so treat any site with comments on as in scope.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T14:16:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116216","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116216","severity":null,"published_at":"2026-10-26T14:16:34+00:00","modified_at":"2026-10-26T14:16:34+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","fetched_at":"2026-10-26T14:30:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}