MacCMS CVE-2026-111356

The attacker must know the victim member's registered email address or phone number, then request a password recovery code and repeatedly submit guesses to findpass_reset; because MacCMS enforces no cap on the number of attempts, the six-digit (one-in-a-million) code can be brute-forced. Requires that public/self-service member registration and password recovery be enabled (default member-facing feature). Limiting factors: the attacker must target a known victim identifier rather than any account at random, the guessing must complete within the recovery code's validity window, and the impact is confined to member accounts as described (not administrator accounts); no authentication (PR:N) and no user interaction (UI:N) are required.

Signals are mostly aligned toward a genuine, high-impact issue but with one important nuance. The CVSS 4.0 base score is 9.1 (Critical) with AV:N/PR:N/UI:N, meaning remote, unauthenticated exploitation with no user interaction, and VC:H/VI:H reflecting full compromise of a member account (read victim data, overwrite password). The vendor's AC:H tempers this slightly, acknowledging the attacker must first know the victim's email or phone and iterate over the code space, so this is a targeted takeover rather than a spray-and-pray mass exploit. CWE-307 (improper restriction of excessive authentication attempts) is corroborated by the referenced User.php source lines, so the root cause is confirmed, not inferred. No EPSS score was provided (cannot gauge statistical exploitation probability) and the CVE is NOT in CISA KEV, so there is no confirmed active exploitation - exploitation status is 'no public exploit identified at time of analysis,' though a detailed public technical writeup (hackmd) describing the exact attack flow and vulnerable code lowers the practical bar significantly and should be treated as near-POC-grade methodology. Net: a real priority for anyone running MacCMS with public member registration, but the need to know a specific victim's email/phone and the targeted nature of a six-digit brute-force keep it from being a wormable, internet-wide crisis. No SSVC decision data was supplied in the input.

An attacker who knows a target member's registered email or phone requests a password recovery code, then scripts automated requests against the findpass_reset endpoint to brute-force the six-digit code because no attempt limit is enforced. Once a code matches, the attacker sets a new password and takes over the victim's account. A public technical writeup detailing the flow and the vulnerable User.php code paths is available, though no packaged exploit tool is confirmed in CISA KEV.