CVE-2026-19356: MingSoft MCMS Information Disclosure Flaw

CVE-2026-19356 Overview

CVE-2026-19356 is an information disclosure vulnerability affecting MingSoft MCMS versions up to 3.0.6. The flaw resides in an unspecified function within the /mdiy/form/data/list endpoint of the ms-mdiy component. Remote attackers can manipulate the endpoint to retrieve data that should not be accessible without authorization. The issue is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. The vendor was contacted before public disclosure but did not respond. A public exploit is referenced in advisory sources, increasing the likelihood of opportunistic exploitation against exposed MCMS deployments.

Critical Impact
Unauthenticated remote attackers can retrieve form data exposed by the ms-mdiy component, leading to disclosure of application content that may include sensitive information.

Affected Products

MingSoft MCMS versions up to and including 3.0.6
ms-mdiy component (form data list functionality)
Deployments exposing /mdiy/form/data/list to untrusted networks

Discovery Timeline

2026-08-09 - CVE-2026-19356 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-19356

Vulnerability Analysis

The vulnerability affects the /mdiy/form/data/list endpoint provided by the ms-mdiy component of MingSoft MCMS. Manipulation of the request triggers information disclosure without requiring authentication or user interaction. The endpoint returns data that should be restricted, allowing attackers to enumerate content that the application stores through its dynamic form module. Because the attack executes over the network with low complexity, adversaries can automate discovery against internet-facing MCMS installations. The advisory notes that the exploit is publicly available, which typically drives an increase in scanning activity. The vendor did not acknowledge disclosure attempts, so no coordinated fix has been announced at the time of publication.

Root Cause

The root cause is missing or insufficient access control enforcement on the /mdiy/form/data/list route. The handler exposes stored form data without validating whether the caller has permission to read it. This mirrors the [CWE-200] pattern where server-side logic returns data outside the intended trust boundary.

Attack Vector

An attacker sends a crafted HTTP request directly to /mdiy/form/data/list on an affected MCMS instance. No credentials, session, or user interaction are required. The server responds with form data records, which the attacker can parse and exfiltrate. Refer to the VulDB entry for CVE-2026-19356 and the associated VulDB Vulnerability #387210 for public technical details.

// No verified proof-of-concept code is reproduced here.
// See VulDB #387210 for public technical details.

Detection Methods for CVE-2026-19356

Indicators of Compromise

Unauthenticated HTTP GET or POST requests to /mdiy/form/data/list from external IP addresses
Repeated access to the ms-mdiy endpoints from a single source within a short time window
Web server responses containing form data records returned to unauthenticated sessions

Detection Strategies

Inspect web server and application access logs for requests to /mdiy/form/data/list originating outside expected administrative sources
Alert on anomalous response sizes from the ms-mdiy endpoint that indicate bulk data retrieval
Correlate scan patterns targeting /mdiy/ paths with threat intelligence on MCMS exploitation activity

Monitoring Recommendations

Forward MCMS application and reverse proxy logs to a centralized analytics pipeline for URI-based analysis
Monitor egress traffic from MCMS servers for unexpected data flows following requests to ms-mdiy routes
Track authentication state on /mdiy/ requests and flag anonymous access to data endpoints

How to Mitigate CVE-2026-19356

Immediate Actions Required

Restrict network access to the MingSoft MCMS administration and /mdiy/ paths using firewall or reverse proxy rules
Place MCMS instances behind an authenticated gateway or VPN if administrative endpoints must remain reachable
Audit stored form data in the ms-mdiy component and remove sensitive fields until a patch is available

Patch Information

No vendor patch has been published. MingSoft did not respond to disclosure attempts referenced in the VulDB submission #865995. Track the VulDB CVE-2026-19356 record and the vendor's release channels for updates beyond version 3.0.6.

Workarounds

Block external access to /mdiy/form/data/list at the web server or WAF layer
Enforce authentication on all /mdiy/ routes through reverse proxy access rules
Rotate any credentials or tokens that may have been stored in exposed form submissions

bash

# Example nginx rule to block unauthenticated access to the vulnerable endpoint
location /mdiy/form/data/list {
    allow 10.0.0.0/8;
    deny all;
    return 403;
}