maccmspro CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

LOW maccmspro CVE published 2026-10-26

CVE-2026-116215

A race condition vulnerability exists in MacCMS v10 through 2026.1000.4056, specifically in the Card::useData() function. This allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint. The vulnerability arises from concurrent flag=card requests that pass the non-locking card read before it is marked used, potentially inflating user_points to buy VIP upgrades and paid content.