CVE-2026-75465
- Source
- https://cve.org/CVERecord?id=CVE-2026-75465
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-75465.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-75465
- Published
- 2026-08-25T00:00:00Z
- Modified
- 2026-08-27T11:47:51.719759454Z
- Summary
- [none]
- Details
-
The /api.php/user/get_list endpoint in Maccms v10 v2026.1000.4055 is vulnerable to an Incorrect Access Control issue. The interface fails to perform any authentication or authorization checks. An unauthenticated remote attacker can send a crafted HTTP GET request with limit and offset parameters to paginate and retrieve sensitive information of all registered users.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75465.json", "cna_assigner": "mitre" }- References
Affected packages
Git / github.com/magicblack/maccms10
Affected versions
V2024.*
V2024.1000.4000
V2024.1000.4010
V2024.1000.4030
V2024.1000.4040
v2020.*
v2020.1000.1035
v2020.1000.1042
v2020.1000.1062
v2020.1000.1068
v2020.1000.1068b
v2020.1000.1069
v2020.1000.1074
v2020.1000.1075
v2020.1000.1080
v2020.1000.1081
v2021.*
v2021.1000.1081
v2022.*
v2022.1000.1099
v2022.1000.3001
v2022.1000.3002
v2022.1000.3004
v2022.1000.3005
v2022.1000.3025
v2022.1000.3026
v2022.1000.3027
v2022.1000.3028
v2022.1000.3029
v2022.1000.3030
v2022.1000.3031
v2022.1000.3032
v2023.*
v2023.1000.3050
v2023.1000.3051
v2023.1000.3052
v2024.*
v2024.1000.3000
v2024.1000.4020
v2024.1000.4044
v2024.1000.4046
v2025.*
v2025.1000.4047
v2025.1000.4048
v2025.1000.4049
v2025.1000.4050
v2025.1000.4051
v2025.1000.4052
v2026.*
v2026.1000.4053
v2026.1000.4054