CVE-2026-75465
Low risk· EPSS 24%Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Incorrect Access Control vulnerability in the /api.php/user/get_list endpoint in Maccms v10 v2026.1000.4055. The interface fails to perform any authentication or authorization checks. An unauthenticated remote attacker can send a crafted HTTP GET request with limit and offset parameters to paginate and retrieve sensitive information of all registered users.
Risk Assessment
An attacker could access all user data, potentially leading to privacy breaches and identity theft.
Recommendation
Implement proper authentication and authorization mechanisms for the /api.php/user/get_list endpoint and restrict access to it.
Other vulnerabilities in Maccms
Original NVD description (English source)
The /api.php/user/get_list endpoint in Maccms v10 v2026.1000.4055 is vulnerable to an Incorrect Access Control issue. The interface fails to perform any authentication or authorization checks. An unauthenticated remote attacker can send a crafted HTTP GET request with limit and offset parameters to paginate and retrieve sensitive information of all registered users.