Answer in brief
CVE-2026-116215 records a Low severity (CVSS 2.3) vulnerability in MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption. The current sources do not mark it as known exploited. The current feed maps maccmspro/maccms10 (generic), magicblack/maccms10 (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 2.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps maccmspro/maccms10 (generic), magicblack/maccms10 (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| maccmspro/maccms10generic | >=0 <=2021.1000.2000 | Not reported |
| magicblack/maccms10generic | >=0 <=2026.1000.4056 | Not reported |
Published upstream
Oct 26, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 26, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 26, 2026
MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint. Attackers can send many concurrent flag=card requests that pass the non-locking card read before it is marked used, inflating user_points to buy VIP upgrades and paid content.
Quoted source text, attributed separately from HOL analysis.