CVE-2026-116216 MEDIUM

CVE-2026-116216: MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment

Vendor Maccmspro
Product maccms10
Weakness CWE-915
Published October 26, 2026
Last update October 26, 2026
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData() that allows unauthenticated attackers to set arbitrary mac_comment columns including user_id. Attackers can submit anonymous comments with a crafted user_id parameter to attribute them to any registered member, displaying that member's avatar and impersonating them.

Key dates

02Disclosure timeline

October 26, 2026 CVE published