Account Takeover Vulnerability in MacCMS v10 by Magicblack

CVE-2026-111356

What is CVE-2026-111356?

Magicblack's MacCMS versions v10 through 2026.1000.4056 are susceptible to an account takeover due to insufficient limits on password recovery attempts. Unauthenticated attackers can exploit this weakness by repeatedly requesting the six-digit password recovery code for any user's account. If they have access to the victim's email or phone number, they can brute-force the code to reset the password and gain unauthorized access to the account. This vulnerability highlights the need for enhanced security measures in the password recovery process to prevent unauthorized account access.

References