Which versions of PHP are affected by CVE-2026-4563?

Organizations using MacCMS should be aware of moderate risk from CVE-2026-4563 rated CVSS 4.3. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2026-4563?

Within 30 days: Identify affected systems running MacCMS and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

PHP CVE-2026-4563

Q: What is the CVSS score of CVE-2026-4563?

CVE-2026-4563 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-14339 LOW

Improper Authorization (CWE-285)

2026-03-23 cna@vuldb.com

GHSA-3f5x-pcjq-3pww

PHP Authentication Bypass

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

CVSS changed

Apr 24, 2026 - 16:37 NVD

4.3 (MEDIUM) 5.3 (MEDIUM)

EUVD ID Assigned

Mar 23, 2026 - 00:22 euvd

EUVD-2026-14339

Analysis Generated

Mar 23, 2026 - 00:22 vuln.today

CVE Published

Mar 23, 2026 - 00:16 nvd

MEDIUM 4.3

DescriptionCVE.org

A weakness has been identified in MacCMS up to 2025.1000.4052. This vulnerability affects the function order_info of the file application/index/controller/User.php of the component Member Order Detail Interface. This manipulation of the argument order_id causes authorization bypass. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

An authorization bypass vulnerability exists in MacCMS up to version 2025.1000.4052 within the Member Order Detail Interface component, specifically in the order_info function of application/index/controller/User.php. An authenticated attacker can manipulate the order_id parameter to access order information belonging to other users, disclosing sensitive data. A public proof-of-concept exploit is available, elevating the risk of active exploitation despite the moderate CVSS 4.3 score.

Technical ContextAI

This vulnerability is rooted in CWE-285 (Improper Authorization), a common weakness in web applications where access control checks fail to properly validate user permissions. The affected component is MacCMS, a PHP-based content management system, specifically the User controller handling order detail retrieval. The vulnerability occurs because the order_id parameter passed to the order_info function is not properly validated against the authenticated user's actual orders, allowing an attacker with valid credentials to enumerate and access other users' order details by simply modifying the order_id value. This represents a classic broken access control flaw where business logic authorization is insufficient despite the presence of authentication.

RemediationAI

Immediately upgrade MacCMS to a patched version beyond 2025.1000.4052, as specified by the vendor. Organizations should consult the official MacCMS security advisory for the exact patched version number and installation instructions. As an interim workaround pending patching, implement network-level access controls restricting the User controller's order_info function to trusted IP ranges, and implement additional application-level authorization checks that verify the requesting user owns the requested order_id before returning any data. Add detailed logging and alerting for order_id parameter variations per user session to detect exploitation attempts. Review all recent order detail access logs for signs of unauthorized access (order_id enumeration patterns) and notify affected users if compromise is suspected.