CVE-2026-116216
Received Received - Intake

Mass Assignment in MacCMS Allows Comment Impersonation

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: VulnCheck

Description
MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData() that allows unauthenticated attackers to set arbitrary mac_comment columns including user_id. Attackers can submit anonymous comments with a crafted user_id parameter to attribute them to any registered member, displaying that member's avatar and impersonating them.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-116216
EUVD
EUVD-2026-109808

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
maccmspro maccms10 0
magicblack maccms10 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-915 The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a mass assignment flaw in MacCMS v10 through 2026.1000.4056 that allows unauthenticated attackers to set arbitrary mac_comment columns, including user_id. Attackers can submit anonymous comments with a crafted user_id parameter to attribute them to any registered member, displaying that member's avatar and impersonating them.

Detection Guidance

To detect this vulnerability, inspect comment submissions in MacCMS v10 through 2026.1000.4056 for unauthenticated requests containing a user_id parameter. Check server logs for POST requests to index/Comment::saveData() with arbitrary user_id values. Look for comments attributed to users who did not create them.

Impact Analysis

This vulnerability enables attackers to impersonate any registered user by submitting comments under their name. The impersonated user's avatar will appear with the comment, making it appear legitimate. This can damage the victim's reputation, spread misinformation, or manipulate discussions without their knowledge.

Mitigation Strategies

Immediately update MacCMS to the latest patched version beyond 2026.1000.4056. If no patch exists, disable anonymous comment posting or implement server-side validation to reject requests with user_id parameters from unauthenticated users. Review and filter existing comments for signs of spoofing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116216. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart