{"id":"CVE-2026-116214","published":"2026-10-26T14:16:34.173","lastModified":"2026-10-26T17:01:22.130","description":"MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-640"],"vendors":[],"products":[],"references":[{"url":"https://github.com/maccmspro/maccms10","tags":[]},{"url":"https://github.com/maccmspro/maccms10/blob/7f388ee0008faf5b01e5df7bf5e5a6ff4bbe13e8/application/common/model/User.php#L607-L630","tags":[]},{"url":"https://github.com/maccmspro/maccms10/issues/30","tags":[]},{"url":"https://github.com/magicblack/maccms10/commit/27bb1b004b9931c93f46b65e9c0e531466e7e02a","tags":[]},{"url":"https://www.vulncheck.com/advisories/maccms-v10-before-2026.1000.4054-account-takeover-via-unbound-password-recovery-code","tags":[]}],"exploitRefs":[{"url":"https://github.com/maccmspro/maccms10","tags":[]},{"url":"https://github.com/maccmspro/maccms10/blob/7f388ee0008faf5b01e5df7bf5e5a6ff4bbe13e8/application/common/model/User.php#L607-L630","tags":[]},{"url":"https://github.com/maccmspro/maccms10/issues/30","tags":[]},{"url":"https://github.com/magicblack/maccms10/commit/27bb1b004b9931c93f46b65e9c0e531466e7e02a","tags":[]}],"hasPoc":true,"ai":{"summary":"An authentication bypass in MacCMS v10 before 2026.1000.4054 allows unauthenticated attackers to reset any user's password by exploiting a missing comparison in the check_msg() function, enabling full account takeover without needing prior credentials.","exploitability":"Trivial to exploit; requires only network access and knowledge of the victim's email or phone number, with no authentication or user interaction needed.","blast_radius":"Any attacker can hijack arbitrary user accounts across the system, leading to unauthorized access, data theft, and potential lateral movement within the application.","remediation":"Upgrade to MacCMS v10 version 2026.1000.4054 or later, which includes a fix that ensures check_msg() properly compares msg_to before accepting password reset requests.","detection":"Look for repeated or anomalous calls to the /user/findpass_msg endpoint followed by /user/findpass_reset with mismatched sender and recipient identifiers (e.g., recovery code requested to attacker's email but reset attempted using victim's email) in web server logs or application audit logs.","tags":["auth-bypass","password-reset","account-takeover","webapp","no-auth"],"model":"garnet-coder","analyzedAt":"2026-10-27T08:50:08.211Z"}}