CVE-2026-111356 MacCMS v10 through 2026.1000.4056 Account Takeover via Password Recovery Brute-Force
Unauthenticated attackers can brute-force six-digit password recovery codes to take over MacCMS member accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-111356?
CVE-2026-111356 is a critical authentication bypass vulnerability in magicblack MacCMS, published on 15 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim's email or phone can request a code and brute-force findpass_reset to overwrite the member's password.
Weakness: CWE-307
Which versions are affected by CVE-2026-111356?
How do I fix CVE-2026-111356?
No fix has been published for CVE-2026-111356 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-111356 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-111356 exists.
Sources
Also known as GHSA-x2wf-9f7g-pjxv.