PT-2026-26080 · Mura Cms · Mura Cms

Published 2026-03-18 · Updated 2026-03-18 · CVE-2025-55041

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MuraCMS versions through 10.1.10

Description The software contains a Cross-Site Request Forgery (CSRF) issue in the Add To Group functionality within user management, specifically in the cUsers.cfc addToGroup method. The issue stems from a lack of CSRF token validation, allowing attackers to escalate privileges by adding any user to any group without proper authorization. The vulnerable function directly processes the userId and groupId parameters through getUserManager().createUserInGorup(). Exploitation involves forging requests that automatically execute when an authenticated administrator visits a malicious page. While escalation to the Super Admins group is not possible, attackers can achieve horizontal privilege escalation to other groups and vertical escalation to the admin group.

Recommendations Versions prior to 10.1.10 should be updated.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-55041

Affected Products

Mura Cms

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-55041 · Security Note
• https://docs.murasoftware.com/v10/release-notes/#section-version-1014 · Note
• https://murasoftware.com · Note
• https://twitter.com/CVEnew/status/2034365323210891491 · Twitter Post