Read the docs
TI-2026-80388 Aliases CVE-2026-116214GHSA-x697-8hfh-c2rc

Password recovery flaw in MacCMS v10 allows account takeover

Priority MEDIUM 48CWE-640Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-640.

Summary

MacCMS v10 from magicblack before 2026.1000.4054 and maccmspro maccms10 from 0 through 2021.1000.2000 are affected. The password recovery check check_msg() never compares the recipient of the recovery code, so a code sent to the attacker's own mailbox is accepted for another member's account (CWE-640). An unauthenticated remote attacker can reset any member's password with the victim's email or phone and take over the account.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00458 39th percentileScored 2026-11-07
Fix Fixed maccms10 (magicblack): 2026.1000.4054

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
maccmspromaccms10up to 2021.1000.2000—No fix listedCNA
magicblackmaccms10before 2026.1000.40542026.1000.4054Patch availableCNA
  • maccms10 Vendormaccmspro Affected up to 2021.1000.2000 Fixed in — No fix listed CNA
  • maccms10 Vendormagicblack Affected before 2026.1000.4054 Fixed in 2026.1000.4054 Patch available CNA

Remediation

Update magicblack maccms10 to version 2026.1000.4054, which fixes this flaw. The sources list no fixed version for maccmspro maccms10.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA maccms10 (magicblack) Fixed in 2026.1000.4054

Timeline

  1. 2026-10-26 Threatist record created from CVE-2026-116214
  2. 2026-10-27 Alias added: GHSA-x697-8hfh-c2rc
  3. 2026-11-04 CISA SSVC decision points changed

References

Patch 1

Other 3

  • TI-2026-80390 Mass assignment in MacCMS lets anonymous comments impersonate users CVSS 4.0MEDIUM 6.9
  • TI-2026-80389 Race condition in MacCMS lets members reuse recharge cards CVSS 4.0LOW 2.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences