The race condition in MacCMS version 10 through 2026.1000.4056 allows an authenticated user to call the Card::useData() function multiple times before the card is marked as used. This flaw is exploited by sending many concurrent requests to the /user/buy endpoint with flag=card, letting the same recharge card increase user_points and enable the user to buy VIP upgrades or paid content. The weakness is a classic race condition (CWE‑362).

MacCMS v10 through 2026.1000.4056 is impacted. This includes releases distributed by maccmspro under the product maccms10 and the magicblack brand maccms10, for all versions in that range.

The CVSS score of 2.3 indicates low overall severity, and the EPSS score is not available, so exploitation likelihood is unknown. The flaw is not listed in the CISA KEV catalog. Attackers would need to be authenticated members of the site and able to issue multiple concurrent requests to the user/buy endpoint, which is feasible for a legitimate user or a malicious actor who has compromised an account. The outcome is an unauthorized increase in user points that can be used for paid services. Since the vulnerability does not permit arbitrary code execution or data disclosure, the risk is limited to financial or privilege abuse.