Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-116215— MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption

Quick assessment

Affected
maccmspro maccms10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MacCMS v10 至 2026.1000.4056 版本在 函数中存在竞态条件漏洞，允许已认证用户通过 接口多次兑换同一张充值卡。攻击者可并发发送大量 请求，这些请求在卡片被标记为“已使用”之前通过了未加锁的卡片读取检查，从而恶意增加用户积分（user_points），进而用于购买 VIP 升级或付费内容。

CVSS 3.1 · Low
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-116215

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption
Source: CVE Program / CVE List V5
Vulnerability Description
MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint. Attackers can send many concurrent flag=card requests that pass the non-locking card read before it is marked used, inflating user_points to buy VIP upgrades and paid content.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用共享资源的并发执行不恰当同步问题(竞争条件)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
maccmspro maccms10 0 ~ 2021.1000.2000 -
magicblack maccms10 0 ~ 2026.1000.4056 -

II. Public POCs for CVE-2026-116215

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-116215

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-116215 (1)

Vendor Pages for CVE-2026-116215 (1)

Other References for CVE-2026-116215 (1)

Same Patch Batch · maccmspro · 2026-10-26 · 3 CVEs total

CVE-2026-116214 9.1 CRITICAL MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code
CVE-2026-116216 5.3 MEDIUM MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment

IV. Related Vulnerabilities

Same product: maccms10
Same vendor: maccmspro
Same weakness: CWE-362