CVE-2026-111356

7.4High

Published 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.4High

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None
Impact: High impact on confidentiality, integrity
Weakness: CWE-307

Impact

Unauthenticated remote attackers can take over user accounts and overwrite passwords. They only need to know the target victim's email or phone number and brute-force the recovery code.

Root cause

The password reset handler lacks rate limiting on verification attempts for the six-digit password recovery code.

Affected systems

MacCMS v10 through 2026.1000.4056

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Fix & remediation

Upgrade to a version past 2026.1000.4056 if available; otherwise, implement rate limiting at the reverse proxy/WAF for the findpass_reset endpoint or disable member password recovery.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim's email or phone can request a code and brute-force findpass_reset to overwrite the member's password.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-111356