Threats tagged 'ghsa-x697-8hfh-c2rc'

MacCMS v10 versions before 2026.1000.4054 have an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password. The flaw exists because the check_msg() function does not verify the recipient of the recovery message, enabling attackers to request a recovery code to their own mailbox and then use it to reset the password of a victim's account via their email or phone.