CVE-2026-111356
HighCVSS 7.4Summary
MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim's email or phone can request a code and brute-force findpass_reset to overwrite the member's password.
Risk Assessment
An attacker can take over any member account if they know the victim's email or phone number, leading to unauthorized access and data breaches. The lack of attempt limits enables an effective brute-force attack on the recovery code.
Recommendation
Update MacCMS to a version newer than 2026.1000.4056 if available, or implement attempt limits and account lockout after failed attempts. Consider increasing the complexity of the password recovery code.
Other vulnerabilities in MacCMS
See all- CVE-2017-17733Critical
Maccms 8.x allows remote command execution via the wd parameter in an index.php?m=vod-search request.
- CVE-2026-75465High
Incorrect Access Control vulnerability in the /api.php/user/get_list endpoint in Maccms v10 v2026.1000.4055. The interface fails to perform any authentication or authorization checks. An unauthenticated remote attacker can send a crafted HTTP GET request with limit and offset parameters to paginate and retrieve sensitive information of all registered users.
Original NVD description (English source)
MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim's email or phone can request a code and brute-force findpass_reset to overwrite the member's password.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS