CVE-2026-75465

Name of the Vulnerable Software and Affected Versions Maccms version v2026.1000.4055

Description The '/api.php/user/get list' endpoint is subject to Incorrect Access Control, which occurs when an application fails to properly restrict access to sensitive data or functions. The interface does not perform authentication or authorization checks, allowing an unauthenticated remote attacker to send a crafted HTTP GET request using the limit and offset parameters to paginate and retrieve sensitive information of all registered users.

Recommendations Update Maccms version v2026.1000.4055 to a version that implements proper authentication and authorization checks for the '/api.php/user/get list' endpoint. As a temporary workaround, restrict access to the '/api.php/user/get list' endpoint to minimize the risk of exploitation.