Maccms v10 EUVD-2026-66179

No special conditions are required - the /api.php/user/get_list endpoint is exposed to any unauthenticated remote attacker with network-level access to the Maccms v10 instance. No authentication, no specific application configuration, and no user interaction is needed beyond sending a standard HTTP GET request. Exploitation is constrained by network accessibility: instances deployed exclusively behind a VPN, internal firewall, or with IP-allowlist restrictions at the network perimeter would not be remotely exploitable. The impact is limited to read-only data exposure (C:H/I:N/A:N) - this endpoint cannot be used to create, modify, or delete records, nor to disrupt service availability.

The CVSS 3.1 score of 7.5 (High) accurately represents the real-world risk profile. The vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N confirms fully unauthenticated, low-complexity network exploitation requiring no user interaction against default-configured deployments - there is no gap between theoretical and practical exploitability. The EPSS score of 0.32% (24th percentile) signals that, despite trivial mechanics, this CVE has not yet been incorporated into widespread threat actor toolkits at time of analysis. No active exploitation is confirmed in CISA KEV. These signals are consistent: the affected product has limited global footprint, which suppresses EPSS even when the technical bar is minimal. The impact is strictly confined to confidentiality (I:N, A:N) - attackers cannot modify records or disrupt service through this vector - but harvested user data (emails, usernames) directly enables credential stuffing and targeted phishing as follow-on campaigns. The combination of low exploitation probability and bounded-but-real confidentiality impact places this as a genuine medium-priority remediation for organizations running Maccms v10 publicly.

An attacker targeting media-streaming sites identifies a publicly accessible Maccms v10 instance and issues GET /api.php/user/get_list?limit=100&offset=0, receiving a paginated JSON payload of registered user records with no credential prompt. By scripting sequential offset increments, the attacker extracts the full user database within minutes and loads harvested email addresses into a credential stuffing tool targeting common email providers and streaming platforms. No public exploit code has been identified at time of analysis, but the attack requires only a browser or curl command.