PT-2026-26080 · Mura Cms · Mura Cms

Publicado 2026-03-18 · Atualizado 2026-03-18 · CVE-2025-55041

Positive Technologies (AI Summary)

CVSS v3.1

8.0

Alta

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MuraCMS versions through 10.1.10

Description The software contains a Cross-Site Request Forgery (CSRF) issue in the Add To Group functionality within user management, specifically in the cUsers.cfc addToGroup method. The issue stems from a lack of CSRF token validation, allowing attackers to escalate privileges by adding any user to any group without proper authorization. The vulnerable function directly processes the userId and groupId parameters through getUserManager().createUserInGorup(). Exploitation involves forging requests that automatically execute when an authenticated administrator visits a malicious page. While escalation to the Super Admins group is not possible, attackers can achieve horizontal privilege escalation to other groups and vertical escalation to the admin group.

Recommendations Versions prior to 10.1.10 should be updated.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2025-55041

Produtos afetados

Mura Cms

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-55041 · Nota de Segurança
• https://docs.murasoftware.com/v10/release-notes/#section-version-1014 · Nota
• https://murasoftware.com · Nota
• https://twitter.com/CVEnew/status/2034365323210891491 · Publicação no Twitter