CVE-2026-4562
Published: 23 March 2026
Summary
CVE-2026-4562 is a high-severity Improper Authentication (CWE-287) vulnerability. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the missing authentication flaw in the Timming API endpoint of MacCMS by identifying, prioritizing, and correcting the specific CVE vulnerability.
Enforces logical access authorizations to prevent unauthorized remote manipulation of the Timming API endpoint lacking authentication checks.
Limits permitted actions without identification or authentication, ensuring the critical Timming API functions require proper authentication to mitigate the vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authentication on public Timming API endpoint directly enables remote exploitation of a public-facing web application without credentials or user interaction.
NVD Description
A security flaw has been discovered in MacCMS 2025.1000.4052. This affects an unknown part of the file application/api/controller/Timming.php of the component Timming API Endpoint. The manipulation results in missing authentication. The attack may be performed from remote. The exploit has…
more
been released to the public and may be used for attacks.
Deeper analysisAI
CVE-2026-4562 is a missing authentication vulnerability affecting MacCMS version 2025.1000.4052. The flaw resides in an unknown part of the file application/api/controller/Timming.php within the Timming API Endpoint component. Published on 2026-03-23, it is associated with CWEs-287 (Improper Authentication) and CWE-306 (Missing Authentication for Critical Function), earning a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
The vulnerability enables remote exploitation without authentication, privileges, or user interaction, requiring only low attack complexity. Attackers can manipulate the endpoint to achieve low-level impacts on confidentiality, integrity, and availability. An exploit for this issue has been publicly released and may be used in attacks.
Advisories and further details, including potential mitigation guidance, are available in the referenced sources: https://github.com/HuajiHD/CVE/issues/9, https://vuldb.com/?ctiid.352399, https://vuldb.com/?id.352399, and https://vuldb.com/?submit.775039.
Details
- CWE(s)