CVE-2026-116214
Last modified
CVE-2026-116214 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account..
Description
MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| maccmspro | maccms10 | <= 2021.1000.2000 |
| magicblack | maccms10 | < 2026.1000.4054 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-116214?
How severe is CVE-2026-116214?
How do I fix CVE-2026-116214?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-116208YesWiki from 4.6.2 before 4.7.0 contains a missing authoriza…8.1
- CVE-2026-11621A weakness has been identified in Dcat-Admin up to 2.2.3-bet…4.7
- CVE-2026-116210Webasyst Framework through 4.4.0 contains a cross-site reque…6.5
- CVE-2026-116211YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnera…8.2
- CVE-2026-116212Webasyst Framework through 4.4.0 contains a stored cross-sit…5.4
- CVE-2026-116213Webasyst Framework through 4.4.0 contains an arbitrary file …4.9
- CVE-2026-116215MacCMS v10 through 2026.1000.4056 contains a race condition …3.1
- CVE-2026-116216MacCMS v10 through 2026.1000.4056 contains a mass assignment…5.3
- CVE-2026-116217RosarioSIS before 12.9.2 contains a reflected cross-site scr…6.1
- CVE-2026-116218Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL inject…7.6
- CVE-2026-116219Dolibarr ERP CRM before 24.0.0 contains an OS command inject…7.2
- CVE-2026-11622A DNSSEC validating resolver that is under a random subdomai…7.5
Are you affected by CVE-2026-116214?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST