CVE Alert: CVE-2026-111356 – magicblack

MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim’s email or phone can request a code and brute-force findpass_reset to overwrite the member’s password.

**Risk verdict:** Treat this as a serious account-takeover risk; urgency cannot be calibrated fully because exploitation and likelihood indicators were not provided.

**Why this matters:** Successful attacks could expose or alter member accounts and enable impersonation or abuse of account-linked features. Impact may extend further if compromised accounts have elevated privileges or users reuse passwords elsewhere, but neither is established here.

**Most likely attack path:** An attacker can reach the recovery flow remotely without an account or victim interaction; high attack complexity suggests brute-forcing may require persistence or favourable conditions. Scope is unchanged, so the direct impact appears confined to the affected application, though stolen credentials could support wider access if reused.

**Who is most exposed:** Publicly reachable MacCMS installations with member registration or password recovery enabled are the most exposed, particularly community or media-content sites. Confirm whether recovery endpoints are internet-accessible and whether any accounts have administrative privileges.

Alert on repeated recovery-code validation failures from one IP, account, or network.

Correlate recovery requests, failed validations, and subsequent password changes.

Look for unusual logins or profile changes immediately after a reset.

Review access logs for distributed or low-rate attempts against multiple accounts.

Mitigation and prioritisation

Verify affected deployments and apply a vendor-supported fix as soon as available; confirm the fix addresses attempt limiting.

Until patched, disable or restrict recovery where operationally acceptable; add rate limits, progressive delays, and abuse monitoring.

Require strong, single-use, short-lived reset tokens and invalidate outstanding tokens after password changes.

Review recent resets and account activity; force resets for suspected compromises.

KEV, SSVC exploitation, PoC, and EPSS data were not supplied, so current exploitation likelihood remains uncertain.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.