MacCMS v10 Password Recovery Flaw Lets Unauthenticated Attackers Take Over Member Accounts (CVE-2026-116214)

CVE-2026-116214 is a critical authentication bypass in MacCMS v10 before 2026.1000.4054. According to the NVD description, an unauthenticated attacker can reset a member's password by reusing a recovery code that was sent to the attacker's own mailbox.

What Is It

The flaw is in the password recovery flow of MacCMS v10. According to the NVD record, the check_msg() function never compares the msg_to field. That means a recovery code is not tied to the account it was issued for.

The attack, as described in the record, runs in two steps:

1. The attacker calls user/findpass_msg to request a recovery code sent to a mailbox they control.
2. The attacker submits that code to user/findpass_reset along with the victim's email or phone number, then sets a new password for the victim's account.

The weakness is classified as CWE-640 (Weak Password Recovery Mechanism for Forgotten Password). VulnCheck reported it and describes it as "account takeover via unbound password recovery code."

Why It Matters

• CVSS 3.1: 9.1 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
• CVSS 4.0: 9.3 (CRITICAL), as a secondary score from VulnCheck

The CVSS vector rates the attack as network-reachable, low complexity, and requiring no privileges or user interaction, with High impact to both confidentiality and integrity. Based on the published description, the main thing an attacker would need is the email address or phone number registered to the target member account. Whether a particular site is exposed may also depend on its configuration, for example whether the member password recovery feature is enabled.

This CVE has no CISA KEV entry in the supplied data, so active exploitation is not confirmed at this time. NVD lists the record's status as "Deferred."

What's Vulnerable

The NVD record lists two affected product lines:

The record gives no example CPEs.

Patch Status

• magicblack/maccms10: Fixed in 2026.1000.4054. The fix commit is linked in the sources below. Operators should upgrade to 2026.1000.4054 or later.
• maccmspro/maccms10: The record names no fixed version for this fork. Operators of this fork should check the project's issue tracker (issue #30) for status.

CISA has issued no required action or due date because there is no KEV listing.

Sources

• NVD – CVE-2026-116214
• VulnCheck Advisory – MacCMS v10 Account Takeover via Unbound Password Recovery Code
• magicblack/maccms10 – Fix Commit 27bb1b0
• maccmspro/maccms10 – Issue #30
• maccmspro/maccms10 – Vulnerable Code (User.php L607–L630)
• maccmspro/maccms10 – Repository