CVE-2026-4563CWE-285CWE-639

MacCMS Member Order Detail User.php order_info authorization

Medium · published March 22, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
31.8
In the wild
Unconfirmed
What it is

A weakness has been identified in MacCMS up to 2025.1000.4052. This vulnerability affects the function order_info of the file application/index/controller/User.php of the component Member Order Detail Interface. This manipulation of the argument order_id causes authorization bypass. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00389 · 31.8th percentile
Weaknesses
CWE-285 · Improper Authorization; CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-03-22T23:51Z
EPSS history
Timeline
  • 22 MAR 23:51Z
    MacCMS Member Order Detail User.php order_info authorization
    cvelistv5