Zero Radar
← feed
CriticalVulnerabilityCVE-2026-116214updated 26 Oct 2026, 14:21 UTC

MacCMS v10: anyone can reset member passwords without logging in

A flaw in the MacCMS website software lets an outsider take over any member's account. The attacker only needs the victim's email or phone number, not a password.

Fixed in MacCMS v10 2026.1000.4054 or laterOfficial source
SeverityCriticalCVSS 9.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesMacCMS v10 2026.1000.4054 or later · since 26 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Attacker requests codeSends recovery request to their own mailbox
  2. 2Code sent to attackerRecovery code goes to attacker-controlled address
  3. 3Code submitted for victimUses victim's email or phone in reset request
  4. 4Check skips recipient matchmsg_to is never compared, so code is accepted
  5. 5Password resetAttacker sets new password for victim account
  6. ResultAttacker controls the victim's account

What happened

In MacCMS v10 before 2026.1000.4054, check_msg() never compares msg_to, so a recovery code sent to the attacker's own mailbox via user/findpass_msg is accepted by user/findpass_reset for a victim's email or phone, enabling an authentication bypass.

Why it is dangerous: Any member account can be taken over by an unauthenticated attacker, exposing personal data and enabling misuse of the account on sites running MacCMS.

Are you affected?

You are affected if you run MacCMS v10 earlier than 2026.1000.4054 with member/password-recovery features enabled.

MacCMS v10, all versions before 2026.1000.4054

What to do

  1. Update MacCMS v10 to 2026.1000.4054 or later
  2. Review member accounts and password reset activity for unexpected changes
  3. Force password resets for accounts that may have been targeted

Timeline

  1. 26 Oct 2026, 14:16 UTC
    Publicly disclosed
  2. 26 Oct 2026, 14:16 UTC
    Reported by NVD · NVD
  3. 26 Oct 2026, 14:21 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-116214
CVSS
9.3 / 10
EPSS
0.5% chance of exploitation within 30 days
Disclosed
26 Oct 2026, 14:16 UTC
On Zero Radar
26 Oct 2026, 14:21 UTC (4 min after disclosure)
Last change
26 Oct 2026, 14:21 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

MacCMS v10: anyone can reset member passwords without logging in · Zero Radar