Is CVE-2026-116215 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-116215?

CVE-2026-116215 has a CVSS v3 severity of LOW (3.1).

Back

CVE-2026-116215

Description

MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint. Attackers can send many concurrent flag=card requests that pass the non-locking card read before it is marked used, inflating user_points to buy VIP upgrades and paid content.