Maccms V10 Through 2026.1000.4056 Account Takeover Via Password Recovery Brute Force

Back www.vulncheck.com

Maccms V10 Through 2026.1000.4056 Account Takeover Via Password Recovery Brute Force

www.vulncheck.com • October 16, 2026

Share: View original

MacCMS v10 through 2026.1000.4056 Account Takeover via Password Recovery Brute-Force

MacCMS <= 2026.1000.4056

MacCMS <= 2026.1000.4056

CWE-307 Improper Restriction of Excessive Authentication Attempts

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CVE-2026-111356: MacCMS v10 Password Recovery Vulnerability A vulnerability (CVE-2026-111356) in MacCMS v10 allows unauthenticated attackers to exploit the password recovery process. The flaw, affecting versions up to 2026.1000.4056, permits brute-force attacks on a six-digit recovery code, enabling account takeovers. Attackers can request recovery codes using a victim's email or phone number, with no limits on attempts, making it feasible to overwrite passwords. The vulnerability is classified as CWE-640 and CWE-307, indicating weak password recovery mechanisms and improper restriction of excessive authentication attempts. Publicly accessible MacCMS installations with member registration or password recovery enabled are at the highest risk. Immediate mitigation steps include applying vendor-supported fixes, disabling recovery features, and monitoring for unusual account activity. The CVSS score for this vulnerability is 9.1, marking it as. As of now, no proof-of-concept or has been confirmed. 1 sources 78

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

CWE-307 - Improper Restriction of Excessive Authentication Attempts

MITRE ATT&CK (1)

T1110 - Brute Force