CVE-2026-116214: Unauthenticated Account Takeover in MacCMS v10

CVE-2026-116214 is an authentication bypass vulnerability affecting MacCMS v10 in versions prior to 2026.1000.4054. The flaw allows an unauthenticated attacker to reset the password of any registered user account, achieving complete account takeover. The technical root cause lies in the check_msg() function, which fails to validate the msg_to parameter: an attacker can request a password recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset using the victim's email or phone number to gain access.

With a CVSS score of 9.1 and critical classification, the vulnerability has critical impact on confidentiality, integrity, and availability of data. It was registered with NVD on October 26, 2026. By November 2026, public signals of available exploits on GitHub repositories were detected, confirming that the threat is real and potentially being used actively.

System administrators managing MacCMS v10 must update immediately to version 2026.1000.4054 or later. Before the update, closely monitor access and password reset logs for anomalous activity, verify that session timeouts and rate limiting are adequate, and if possible restrict password reset functionality to authenticated users only.