CVE-2026-75465: Maccms v10 Authentication Bypass Vulnerability

CVE-2026-75465 Overview

CVE-2026-75465 is an incorrect access control vulnerability in Maccms v10 version v2026.1000.4055. The affected /api.php/user/get_list endpoint fails to enforce authentication or authorization checks. An unauthenticated remote attacker can issue a crafted HTTP GET request with limit and offset parameters to paginate through and exfiltrate sensitive information for every registered user. The flaw enables mass enumeration of user records without credentials, prior access, or user interaction.

Critical Impact
Remote unauthenticated attackers can retrieve the full registered user database of an affected Maccms v10 instance through a single publicly reachable API endpoint.

Affected Products

Maccms v10 version v2026.1000.4055
Deployments exposing the /api.php/user/get_list endpoint
Web-facing Maccms installations without upstream access controls

Discovery Timeline

2026-08-25 - CVE-2026-75465 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-75465

Vulnerability Analysis

Maccms v10 is a widely deployed PHP-based content management system used to operate video and streaming sites. The /api.php/user/get_list endpoint exposes paginated user records through the standard API dispatcher. The handler processes the limit and offset query parameters and returns matching user rows directly to the caller.

The endpoint does not validate a session, API token, or administrator role before executing the query. Any unauthenticated client can iterate through the dataset by incrementing offset until the full user table has been retrieved. Returned records disclose account attributes that support further account takeover, credential-stuffing, and targeted phishing activity.

Root Cause

The root cause is missing authorization enforcement on a privileged API route, an instance of Broken Access Control. The handler assumes callers are authenticated administrators without validating that assumption. No middleware, decorator, or in-function permission check gates the query before results are serialized to the response.

Attack Vector

Exploitation requires only network reachability to the target site. An attacker sends repeated HTTP GET requests to /api.php/user/get_list?limit=<n>&offset=<m>, adjusting offset between requests to walk the full user list. No credentials, tokens, or CSRF context are required. Consult the GitHub Security Advisory for CVE-2026-75465 for the request format and disclosed fields.

Detection Methods for CVE-2026-75465

Indicators of Compromise

Unauthenticated HTTP GET requests to /api.php/user/get_list in web server access logs.
Sequential or incrementing offset values from a single source IP or small IP set within a short window.
Large response payloads from /api.php/user/get_list correlated with client requests lacking session cookies.

Detection Strategies

Alert on any request to /api.php/user/get_list that does not carry an authenticated administrator session.
Baseline request volume to /api.php/user/* routes and flag sudden spikes indicative of enumeration.
Correlate outbound web responses containing user record fields with the originating endpoint path.

Monitoring Recommendations

Ingest Maccms web server access logs into a centralized analytics platform for pattern analysis.
Track per-IP request rates against /api.php/user/get_list and enforce thresholds.
Monitor for reconnaissance follow-through such as authentication attempts against enumerated usernames.

How to Mitigate CVE-2026-75465

Immediate Actions Required

Restrict access to /api.php/user/get_list at the web server or reverse proxy layer until a vendor patch is applied.
Block unauthenticated requests to the /api.php/user/ route family with a web application firewall rule.
Audit web server logs for prior exploitation and rotate credentials for any exposed accounts.

Patch Information

Monitor the Maccms10 GitHub releases page for a fixed build that enforces authentication on the user/get_list handler. Upgrade to a patched release as soon as it is published by the maintainers.

Workarounds

Add an authentication check in front of /api.php/user/get_list via reverse proxy configuration (for example, nginxauth_request or an allow/deny list scoped to administrator networks).
Deploy a WAF signature that blocks unauthenticated GET requests to /api.php/user/get_list and rate-limits the parent path.
Restrict the Maccms admin API surface to an internal VPN or bastion network until the upstream fix is deployed.

bash

# Example nginx block restricting the vulnerable endpoint
location ~* ^/api\.php/user/get_list {
    allow 10.0.0.0/8;      # administrator network
    deny all;
    return 403;
}