CVE-2026-116214

MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because checkmsg never compares msgto. Attackers can request a recovery code to their own mailbox via user/findpassmsg, then submit it to...

CVE-2026-116214

MacCMS v10 versions prior to 2026.1000.4054 are susceptible to an authentication bypass vulnerability. The root cause is that the check_msg() function fails to compare the msg_to parameter. This allows unauthenticated attackers to perform an account takeover by requesting a recovery code to their...

EUVD-2026-109806

MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because checkmsg never compares msgto. Attackers can request a recovery code to their own mailbox via user/findpassmsg, then submit it to...