CVE-2026-75465
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
Incorrect Access Control vulnerability in the /api.php/user/get_list endpoint in Maccms v10 v2026.1000.4055. The interface fails to perform any authentication or authorization checks. An unauthenticated remote attacker can send a crafted HTTP GET request with limit and offset parameters to paginate and retrieve sensitive information of all registered users.
Risk Assessment
An attacker could access all user data, potentially leading to privacy breaches and identity theft.
Recommendation
Implement proper authentication and authorization mechanisms for the /api.php/user/get_list endpoint and restrict access to it.
Other vulnerabilities in Maccms
See all- CVE-2026-111356High
MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim's email or phone can request a code and brute-force findpass_reset to overwrite the member's password.
- CVE-2017-17733Critical
Maccms 8.x allows remote command execution via the wd parameter in an index.php?m=vod-search request.
Original NVD description (English source)
The /api.php/user/get_list endpoint in Maccms v10 v2026.1000.4055 is vulnerable to an Incorrect Access Control issue. The interface fails to perform any authentication or authorization checks. An unauthenticated remote attacker can send a crafted HTTP GET request with limit and offset parameters to paginate and retrieve sensitive information of all registered users.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS