MacCMS v10 suffers a severe authentication bypass that lets an unauthenticated attacker reset any member’s password without verification. The flaw stems from the findpass_msg endpoint never validating that the recovery code was sent to the intended user; an attacker can request a code to their own mailbox and then submit it along with the victim’s email or phone to findpass_reset, effectively taking over the account. This leads to complete compromise of the victim’s credentials, allowing the attacker to access and control the account’s data and privileges.

The vulnerability affects installations of MacCMS v10 from the maccmspro and magicblack vendors. All versions prior to 2026.1000.4054 are vulnerable. The affected product is the MacCMS content management system, which is used by web sites built on it.

The CVSS score of 9.3 classifies this as critical, and the EPSS score is currently unavailable, indicating that accurate exploitation probability is unknown but the flaw is known to be severe. The vulnerability is listed outside CISA’s KEV catalog, but that does not diminish its danger. The attack vector is clearly remote and unauthenticated: an attacker only needs to communicate with the public findpass_msg and findpass_reset endpoints. Once the recovery code is obtained and paired with the victim’s contact information, the attacker can immediately assume ownership of the account. The minimal prerequisites and remote nature mean that any exposed MacCMS v10 installation is at high risk.