CVE-2026-75465

An Incorrect Access Control vulnerability exists in the /api.php/user/get_list endpoint of Maccms v10 (version v2026.1000.4055 ). The endpoint performs no authentication or authorization checks, allowing an unauthenticated remote attacker to send a crafted HTTP GET request with limit and offset p...