The vulnerability is a mass‑assignment flaw residing in the Comment::saveData method of MacCMS v10, allowing unauthenticated attackers to submit a crafted user_id field that causes the system to attribute the comment to any registered user. This user impersonation can mislead site visitors into believing the comment originates from that member, potentially enabling social‑engineering or defacement attacks.

Affected software includes MacCMS Pro’s MacCMS10 and MagicBlack’s MacCMS10, specifically versions ranging from v10 up to 2026.1000.4056. Any installation that has not applied a later release that removes the mass‑assignment logic is vulnerable. No other vendors or product lines are known to be affected.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is inferred to be remote over the web interface—an unauthenticated user can post a comment through the public comment submission endpoint. Attackers can exploit this by submitting a crafted request that includes a user_id parameter set to any registered member’s identifier, thereby creating an illusion that the member is posting the comment. This can erode trust in the platform and serve as a foothold for further social‑engineering or phishing campaigns.