CVE-2026-111356 Details

A vulnerability in MacCMS version 10, through release 2026.1000.4056, allows unauthenticated attackers to take over member accounts by brute-forcing the six-digit password recovery code. The recovery process does not limit the number of attempts, enabling attackers who know a victim's email or phone to request a code and overwrite the victim's password. This issue arises because the recovery code is easily guessable, and the verification route lacks proper security measures such as rate limiting or lockouts.

The vulnerability can be remediated by implementing several measures: Increase the length of the recovery code to at least 8 to 10 digits or use an alphanumeric token to enhance its complexity. Introduce a persistent failed-attempt counter for the recovery process, with lockout mechanisms per contact after a small number of incorrect guesses. Additionally, add a per-IP rate limit on the recovery routes and consider placing a captcha on the completion route to prevent automated attacks.