CVE-2026-116216 in MacCMS
Summary
by MITRE • 10/26/2026
MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData() that allows unauthenticated attackers to set arbitrary mac_comment columns including user_id. Attackers can submit anonymous comments with a crafted user_id parameter to attribute them to any registered member, displaying that member's avatar and impersonating them.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/26/2026
The identified vulnerability in MacCMS versions 10 through 2026.1000.4056 represents a critical mass assignment flaw located within the index/Comment::saveData() function. Mass assignment vulnerabilities occur when an application automatically binds user-supplied input to model properties or database fields without proper validation of which attributes are permitted for modification by that specific user context. In this instance, the saveData method fails to enforce strict allow-listing of modifiable fields during the comment creation process. This architectural oversight allows unauthenticated attackers to inject arbitrary parameters into the request payload, specifically targeting internal identifiers such as the user_id field. By manipulating this parameter, an attacker can bypass standard authentication and authorization checks that would normally restrict comment attribution to the currently logged-in session or anonymous status.
The operational impact of this vulnerability is significant due to its potential for identity impersonation and social engineering attacks. When a crafted request includes a specific user_id corresponding to a registered member, the system attributes the new comment to that legitimate account rather than leaving it as an unauthenticated entry. Consequently, the platform displays the victim's avatar alongside their username in the public comments section. This creates a deceptive environment where other users perceive the malicious content as originating from the trusted individual. Such impersonation can be leveraged for phishing campaigns, reputation damage, or spreading misinformation under the guise of a legitimate community member. The lack of authentication required to exploit this flaw further exacerbates the risk, allowing any external actor on the internet to execute these attacks without prior access credentials.
From a classification perspective, this vulnerability aligns with CWE-915, which describes Improper Control of Dynamically-Managed Code Resources, specifically falling under the sub-category of mass assignment or unrestricted object modification. It also relates closely to CWE-284, indicating improper access control where insufficient restrictions are placed on user input affecting internal logic. In terms of adversary tactics, this exploitation technique maps to MITRE ATT&CK techniques related to Account Manipulation and Impersonation, such as T1098 (Account Manipulation) or more broadly the initial foothold phase if used for credential harvesting via fake interactions. The core issue lies in the framework's default behavior of binding all incoming request parameters to the model object without filtering out sensitive fields that should remain immutable by end-users.
To mitigate this vulnerability, developers must implement strict input validation and field whitelisting within the saveData method or the underlying ORM layer. Instead of allowing automatic mapping of all POST data, the application should explicitly define which columns are safe for user submission, typically excluding identifiers like user_id, role, permissions, or timestamps that are managed by the system backend. Additionally, implementing server-side checks to verify that the authenticated session's identity matches any provided user identifier would provide a robust defense-in-depth measure. Even if mass assignment occurs, verifying that the current request context has permission to modify records for other users prevents unauthorized attribution updates. Regular security audits focusing on controller logic and model binding configurations are essential to prevent similar flaws in dynamic web applications using MacCMS or comparable frameworks.