CVE-2026-111356: Improper Restriction of Excessive Authentication Attempts in magicblack MacCMS

MacCMS versions from 0 up to and including 2026.1000.4056 do not impose limits on attempts to enter the six-digit password recovery code. This lack of restriction permits unauthenticated attackers to brute-force the recovery code by repeatedly requesting it using a known victim's email or phone number. Successful brute-forcing allows the attacker to reset and overwrite the victim's password, resulting in account takeover.

An attacker can gain unauthorized access to user accounts by brute-forcing the password recovery code, leading to account takeover. This compromises the confidentiality and integrity of user accounts within the affected MacCMS installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement rate limiting or other controls on password recovery attempts to prevent brute-force attacks.