CVE-2026-116214

Critical

Description

MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account.

SeverityCritical

CVSS9.1

Exploit probability—

ProductMaccmspro Maccms10

PublishedOct 26, 2026

First seenOct 26, 2026

Weakness typeCWE-640CWE-640

How to fix

Update

magicblack maccms102026.1000.4054 or later

Patches

github.com/magicblack/maccms10/commit/27bb1b004b9931c93f46b65e9c0e531466e7e02a

Affected products

Product	Affected versions	Fixed in
maccmspro maccms10	v ≤ 2021.1000.2000	—
magicblack maccms10	v < 2026.1000.4054	2026.1000.4054

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.