Summary
generated automatically from NVD dataMacCMS v10 before 2026.1000.4054 has an authentication bypass in its password recovery flow, because the check_msg() function never compares msg_to against the intended recipient. An unauthenticated attacker can request a recovery code sent to their own mailbox through user/findpass_msg, then submit it to user/findpass_reset with a victim's email or phone, resetting that member's password and taking over the account. The flaw is rated CRITICAL with a CVSS v3.1 score of 9.1 and is classed as CWE-640.
NVD description
MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account.
EPSS · FIRST.org
0.46%probability of exploitation in the next 30 days
Higher than 39% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-27, recomputed daily by FIRST.org.
In-depth analysis on cveo.tech
This CVE is covered in an article: context, affected versions and published fixes.
CVSS v3.1 Score
Information
- Published
- 26 oct. 2026
- Updated
- 26 oct. 2026
- Status
- Deferred
- Source
- disclosure@vulncheck.com
Weaknesses (CWE)
References (5)
Similar CVEs
Other vulnerabilities of type CWE-640
Know which CVEs hit the versions you run.
Add the product and its version: cveo.tech lists the CVEs that affect it right away, then alerts you by email when a new one affects it — including before NVD has finished its analysis. Free, an account is all it takes.