Threats tagged 'ghsa-9f7c-9m42-3x6j'

MacCMS versions up to 2026.1000.4056 have a mass assignment vulnerability in the index/Comment::saveData() function. This flaw allows unauthenticated attackers to set arbitrary mac_comment fields, including user_id, enabling them to submit comments that appear to come from any registered user. As a result, attackers can impersonate members by displaying their avatars alongside the forged comments.