CVE-2026-116214 in MacCMS
Summary
by MITRE • 10/26/2026
MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
The vulnerability identified in MacCMS versions prior to 2026.1000.4054 represents a critical authentication bypass flaw rooted in improper validation of input parameters during the password recovery workflow. This issue specifically affects the user management module, where the function check_msg() is responsible for verifying the integrity and destination of message-based verification codes used for account recovery. The core technical defect lies in the failure to compare the msg_to parameter against the intended recipient's identity before processing the reset request. By omitting this critical validation step, the application fails to enforce proper access control mechanisms, allowing an attacker to manipulate the flow of sensitive authentication data without authorization.
From a technical perspective, the exploitation path begins with the attacker initiating a password recovery process for their own account through the user/findpass_msg endpoint. This action generates a valid verification code associated with the attacker's registered email address or phone number. Because the system does not strictly bind this generated token to the specific identity requesting it during subsequent validation steps, the attacker can then submit this legitimate code to the user/findpass_reset endpoint while specifying the victim's email address or phone number as the target for the password reset. The application accepts the valid code and proceeds with resetting the password for the specified victim account, effectively bypassing any requirement that the recovery request originate from the actual owner of the account.
This vulnerability falls under CWE-287, which describes Improper Authentication, specifically relating to the failure to properly verify identity before granting access or performing sensitive actions. It also aligns with MITRE ATT&CK technique T1098, Account Manipulation, as it enables an adversary to gain unauthorized control over user accounts by exploiting weaknesses in account recovery procedures. The operational impact is severe, as it allows unauthenticated attackers to take full ownership of any member's account on the platform. This compromise can lead to data breaches, unauthorized content publication, and further lateral movement within systems that rely on MacCMS for identity management or session handling.
Mitigation strategies must focus on enforcing strict binding between verification tokens and their intended recipients. Developers should modify the check_msg() function to validate that the msg_to parameter matches the user account associated with the provided recovery code before allowing any password reset operations. Additionally, implementing rate limiting on password recovery requests can help mitigate automated exploitation attempts. Organizations using affected versions of MacCMS are strongly advised to upgrade immediately to version 2026.1000.4054 or later, where this validation logic has been corrected. Until the patch is applied, administrators should consider disabling public-facing password recovery features if they are not essential for business operations, thereby reducing the attack surface available to potential adversaries.