CVE-2026-116216 Details
Description
MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData() that allows unauthenticated attackers to set arbitrary mac_comment columns including user_id. Attackers can submit anonymous comments with a crafted user_id parameter to attribute them to any registered member, displaying that member's avatar and impersonating them.
A mass assignment vulnerability has been identified in MacCMS version 10, affecting releases through 2026.1000.4056. The issue resides in the Comments controller's saveData() function, where unauthenticated attackers can manipulate mac_comment columns, including user_id. This vulnerability allows attackers to submit anonymous comments with a specified user_id, thereby attributing the comments to any registered user. The impersonated user’s avatar is displayed, further enhancing the deception.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/maccmspro/maccms10 | [email protected] | Vendor |
| https://github.com/maccmspro/maccms10/blob/7f388ee0008faf5b01e5df7bf5e5a6ff4bbe13e8/application/index/controller/Comment.php#L37-L95 | [email protected] | Source CodeVendor |
| https://github.com/maccmspro/maccms10/issues/30 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/maccms-v10-through-2026.1000.4056-comment-impersonation-via-user-id-mass-assignment | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-915 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| MacCMS | <= 2021.1000.2000 (semver) <= 2026.1000.4056 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |