MacCMS is vulnerable because the six‑digit password recovery code can be requested repeatedly without any limitation. This allows an attacker to brute‑force the recovery code and reliably set a new password for any account whose email or phone number is known. The result is the attacker gaining full access to the victim’s account, potentially exposing all data associated with that account and allowing further attack vectors from within the authenticated session. The weakness is identified as CWE‑307, an authentication bypass by request forgery or lack of rate control. The impact is severe: confidentiality and integrity of user accounts are lost, and the attacker may carry out additional actions such as data exfiltration or lateral movement within the CMS.

The flaw affects magicblack’s MacCMS, versions 10 through 2026.1000.4056. Older releases prior to this version family are not mentioned as impacted.

The CVSS score of 9.1 places this issue in the Critical severity range, underscoring the high risk when exploitation is feasible. The EPSS score of 0.00342 (less than 1%) indicates a very low but non‑zero probability that an attacker will successfully exploit this vulnerability out of the many requests they could generate, highlighting that the lack of rate limiting makes the attack trivial once an attacker is active. The vulnerability is not listed in the CISA KEV catalog, yet the remote nature and the possibility of mass compromise warrant immediate remediation.