CVE-2026-111356

Received Received - Intake

Unauthenticated Password Reset in MacCMS

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim's email or phone can request a code and brute-force findpass_reset to overwrite the member's password.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-10-16

EPSS Evaluated

N/A

NVD

CVE-2026-111356

Affected Vendors & Products

Vendor	Product	Version / Range
magicblack	MacCMS	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-307	The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Attack-Flow Graph

Executive Summary

MacCMS v10 through 2026.1000.4056 has a flaw where the six-digit password recovery code does not have attempt limits. This allows unauthenticated attackers to brute-force the findpass_reset function, request codes for a victim's email or phone, and reset their password to take over the account.

Impact Analysis

Attackers can gain unauthorized access to user accounts by exploiting the weak password recovery mechanism. This could lead to data theft, account misuse, or further compromise of sensitive information tied to the account.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by enabling unauthorized access to personal or sensitive data. Organizations may face compliance breaches, legal penalties, or reputational damage due to insufficient account security controls.

Mitigation Strategies

Implement rate limiting on password recovery code attempts to prevent brute-force attacks. Ensure the six-digit recovery code has a short expiration time and lock accounts after multiple failed attempts.

Hi! I’m here to help you understand CVE-2026-111356. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70