dbcve.org
Improper AuthorizationWeakness · CWE-285

CVE-2026-15516

MEDIUM · 5.6 CVSS v3.1 Published 2026-07-13
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
65/100
Remediation priority · Elevated
Remotely reachable No privileges Zero-click 5 weeks old

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
A vulnerability was detected in MacCMS Pro up to 2022.1000.3005. Impacted is the function step5 of the file application/install/controller/Index.php of the component Installation Module. The manipulation results in authorization bypass. The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit is now public and may be used. Upgrading to version 2022.1000.3025 is recommended to address this issue. Upgrading the affected component is recommended.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

Authorization bypass vulnerability in MacCMS Pro's installation module. The step5 function in application/install/controller/Index.php can be manipulated to bypass authorization controls, potentially allowing unauthorized completion of the installation process or access to administrative functions.

MitigationUpgrade MacCMS Pro from any version up to 2022.1000.3005 to version 2022.1000.3025 or later to remediate this authorization bypass vulnerability.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Confirm MacCMS Pro installation exists
    Locate the application/install/ directory in the web root. Check for the presence of Index.php in application/install/controller/
    Affected if The MacCMS Pro application/install/ directory exists on the server and is accessible via web
  2. Identify the installed version
    Open application/common/config/version.php or check the version file in the application root. Compare the version number to 2022.1000.3005
    Affected if The installed version is 2022.1000.3005 or lower
  3. Check if installation is completed
    Look for the file data/install.lock or similar lock file in the application directory. Also check if config/config.php exists with database credentials populated
    Affected if The installation lock file does not exist or installation has not been finalized, exposing the vulnerable installation module
  4. Verify installation module is accessible
    Attempt to access the URL path /install/index/index or /install/index/step5 via HTTP request to see if the installation wizard is still reachable
    Affected if The installation module responds and allows progression through steps, indicating it has not been locked down
  5. Inspect step5 function authorization
    Review the code in application/install/controller/Index.php around the step5 function for missing authorization checks or validation logic
    Affected if The step5 function lacks proper authorization validation before executing installation completion actions

A user is affected if MacCMS Pro version 2022.1000.3005 or lower is installed and the installation module is accessible or has not been properly locked after initial setup.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Upgrade MacCMS Pro from any version up to 2022.1000.3005 to version 2022.1000.3025 or later to remediate this authorization bypass vulnerability.

Recommended fix High confidence

2022.1000.3025

  1. Back up the current MacCMS Pro installation including all files and the database
  2. Download MacCMS Pro version 2022.1000.3025 from the official vendor website or trusted source
  3. Replace the existing application/install/controller/Index.php file with the version from 2022.1000.3025
  4. Alternatively, perform a fresh installation using version 2022.1000.3025 if the upgrade path is not supported
  5. After applying the fix, verify that the installation module's step5 function now properly enforces authorization checks
  6. Test the application functionality to ensure the upgrade did not break existing features
  7. Remove the installation directory (application/install/) from production environments after setup is complete to reduce attack surface
Caveat Test the upgrade in a non-production environment first as minor compatibility issues may occur with custom themes or plugins

Generated from the published advisory — verify against the referenced sources before acting.

Have this fixed Scoped from the published advisory
  • Consultation2.0 h
  • Implementation2.0 h
  • Testing2.0 h
  • Review / QA1.0 h
7.0 hours of engineering $1,240
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $1,984.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-15516 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-15516 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data