Race Condition Vulnerability in MacCMS by MacCMSPro
CVE-2026-116215

2.3LOW

Key Information:

Vendor

Maccmspro

Status
Maccms10
Vendor
CVE Published:
26 October 2026

What is CVE-2026-116215?

Recent findings reveal a race condition vulnerability in MacCMS versions 10 through 2026.1000.4056. This flaw exists in the Card::useData() method, allowing authenticated users to repeatedly redeem a single recharge card by sending concurrent requests to the user/buy endpoint. The vulnerability arises from non-locking reads of card status, enabling attackers to inflate user_points unlawfully, potentially gaining unauthorized access to VIP upgrades and premium content.

Affected Version(s)

maccms10 0 <= 2021.1000.2000

maccms10 0 <= 2026.1000.4056

References

https://github.com/maccmspro/maccms10/issues/30
issue-tracking
https://github.com/maccmspro/maccms10/blob/7f388ee0008faf...
technical-description
https://github.com/maccmspro/maccms10
product

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abu Raihan Biswas
.