MacCMS: Authentication bypass in password recovery (CVE-2026-116214)

MacCMS v10 versions prior to 2026.1000.4054 contain a critical vulnerability in the password reset process. The check_msg() function fails to validate the msg_to parameter during password recovery, enabling an attacker to bypass authentication. An attacker can initiate a password recovery request for a target account, intercept the recovery code sent to their own controlled address, and submit that code to the user/findpass_reset endpoint with the victim's email or phone number to change the password and gain unauthorized access.

Impact

Successful exploitation allows unauthenticated attackers to gain full control over any member account, potentially leading to unauthorized data access or administrative account compromise.

Recommendation

• Patch MacCMS v10 to version 2026.1000.4054 or later immediately.
• Audit web server logs for suspicious spikes in requests to user/findpass_msg and user/findpass_reset from single source IPs, which may indicate automated account takeover attempts.