{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/maccms/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:maccms:maccms:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-111356"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MacCMS (v10 through 2026.1000.4056)"],"_cs_severities":["high"],"_cs_tags":["web-application","account-takeover","vulnerability","cve-2026-111356"],"_cs_type":"advisory","_cs_vendors":["MacCMS"],"content_html":"\u003cp\u003eMacCMS versions v10 through 2026.1000.4056 contain a critical vulnerability in the password recovery mechanism that fails to enforce rate limiting on six-digit recovery codes. This flaw allows an unauthenticated attacker to abuse the 'findpass_reset' function by systematically brute-forcing the verification code required to reset a user's password. An attacker requires only the target's associated email address or phone number to initiate the recovery workflow. Once the correct six-digit code is guessed, the attacker can overwrite the member's existing password, leading to complete account takeover. This vulnerability is particularly impactful in multi-user environments where member account security is essential.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability poses a high risk of unauthorized account access, potentially leading to data exfiltration, account impersonation, and unauthorized administrative actions within the MacCMS application. Given the ubiquity of CMS platforms, any site running vulnerable versions is susceptible to automated account takeover campaigns.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor web access logs for high-frequency POST requests to the 'findpass_reset' endpoint from a single source IP address, which may indicate automated brute-force attempts.\u003c/li\u003e\n\u003cli\u003eImplement rate limiting or account lockout policies at the web application firewall (WAF) or web server level for the password recovery module.\u003c/li\u003e\n\u003cli\u003eUpgrade MacCMS to a patched version beyond 2026.1000.4056 as soon as the vendor provides a remediation.\u003c/li\u003e\n\u003cli\u003eAudit user account logs for suspicious password resets that do not correspond with user-initiated activity.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-15T22:50:26Z","date_published":"2026-10-15T22:50:26Z","id":"https://feed.craftedsignal.io/briefs/2026-10-maccms-password-reset-bypass/","summary":"MacCMS versions v10 through 2026.1000.4056 are vulnerable to an unauthenticated account takeover via brute-force exploitation of the password recovery function.","title":"Unauthenticated Account Takeover in MacCMS via Password Recovery Rate Limiting Bypass","url":"https://feed.craftedsignal.io/briefs/2026-10-maccms-password-reset-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - MacCMS","version":"https://jsonfeed.org/version/1.1"}