{"id":"CVE-2026-111356","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-111356","summary":"MacCMS v10 through 2026.1000.4056 Account Takeover via Password Recovery Brute-Force","details":"MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim's email or phone can request a code and brute-force findpass_reset to overwrite the member's password.","published":"2026-10-15T21:43:45.212Z","modified":"2026-10-17T02:48:26.449919778Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111356.json"},{"type":"ADVISORY","url":"https://hackmd.io/@hieuPenguinnn/maccms10-password-reset-code-brute-force-account-takeover"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111356"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/maccms-v10-through-2026.1000.4056-account-takeover-via-password-recovery-brute-force"},{"type":"PACKAGE","url":"https://github.com/magicblack/maccms10"},{"type":"ARTICLE","url":"https://github.com/magicblack/maccms10/blob/v2026.1000.4056/application/common/model/User.php#L1199-L1231"},{"type":"ARTICLE","url":"https://github.com/magicblack/maccms10/blob/v2026.1000.4056/application/common/model/User.php#L1397-L1450"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-17T02:48:26.449919778Z"}}