CVE-2026-116214

Summary

An authentication bypass in MacCMS v10 before 2026.1000.4054 allows unauthenticated attackers to reset any user's password by exploiting a missing comparison in the check_msg() function, enabling full account takeover without needing prior credentials.

Exploitability

Trivial to exploit; requires only network access and knowledge of the victim's email or phone number, with no authentication or user interaction needed.

Blast radius

Any attacker can hijack arbitrary user accounts across the system, leading to unauthorized access, data theft, and potential lateral movement within the application.

Detection

Look for repeated or anomalous calls to the /user/findpass_msg endpoint followed by /user/findpass_reset with mismatched sender and recipient identifiers (e.g., recovery code requested to attacker's email but reset attempted using victim's email) in web server logs or application audit logs.

Prioritized remediation

Upgrade to MacCMS v10 version 2026.1000.4054 or later, which includes a fix that ensures check_msg() properly compares msg_to before accepting password reset requests.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.