MacCMS: authentication bypass

maccmspro maccms10

MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to.

Do this now

Check the advisory for a fix and restrict access to maccmspro maccms10 meanwhile.

First seen: 6 Nov 2026
Last update: 6 Nov 2026, 04:17 UTC
Versions per the CVE record from VulnCheck, not the vendor: 2026.1000.4054
Identifiers: CVE-2026-116214
CVSS: 9.1
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## MacCMS: authentication bypass
Severity: critical. Patch status: fix status unknown.
Affected: maccmspro maccms10
Versions per the CVE record from VulnCheck, not the vendor: 2026.1000.4054
Ids: CVE-2026-116214

MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to.

## Steps
1. Search the repo, its CI and infra config for maccmspro maccms10. If present, report the version in use and whether it's affected.
2. Versions per the CVE record from VulnCheck, not the vendor: maccmspro maccms10: 2026.1000.4054; <= 2021.1000.2000 → no fix on 2021.x yet. Don't treat them as a fix until the vendor says so.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| maccmspro maccms10 | per the CVE record from VulnCheck, not the vendor | 2026.1000.4054 | restrict network access to it |
| maccmspro maccms10 <= 2021.1000.2000 | per the CVE record from VulnCheck, not the vendor | no fixed version listed | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-116214") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://github.com/maccmspro/maccms10 https://nvd.nist.gov/vuln/detail/CVE-2026-116214
https://pwned.coffee/i/maccms-authentication-bypass-cve-2026-116214

Receipt

Exploitation: No known exploitation
By release line, per the CVE record from VulnCheck, not the vendor: Product Affected Version named Source
maccmspro maccms10 before 2026.1000.4054 2026.1000.4054 CVE record (CNA) per the CVE record from VulnCheck, not the vendor checked 6 Nov
maccmspro maccms10 <= 2021.1000.2000 no fix on 2021.x yet CVE record (CNA) per the CVE record from VulnCheck, not the vendor checked 6 Nov
Score: CVSS 9.1 (critical). CVSS 3.1 9.1 (CNA VulnCheck) for CVE-2026-116214
Last checked: 6 Nov 2026, 12:18 UTC

Product	Affected	Version named	Source
maccmspro maccms10	before 2026.1000.4054	2026.1000.4054	CVE record (CNA) per the CVE record from VulnCheck, not the vendor checked 6 Nov
maccmspro maccms10	<= 2021.1000.2000	no fix on 2021.x yet	CVE record (CNA) per the CVE record from VulnCheck, not the vendor checked 6 Nov

Sources: KEV – CVE record ✓ Vendor –

Sources

Follow on X

Totalone very hot coffee