CVE-2026-116215

MacCMS versions v10 through 2026.1000.4056 are vulnerable to a race condition in the Card::useData() function. This flaw allows authenticated members to redeem a single recharge card multiple times by sending concurrent flag=card requests via the user/buy endpoint. Because the system performs a n...