Vulnerability Allows Bypassing Group Restrictions in Masa CMS
CVE-2024-32643

7.5HIGH

Key Information:

Vendor

Masacms

Status
Masacms
Vendor
CVE Published:
3 December 2025

What is CVE-2024-32643?

Masa CMS, an open-source Enterprise Content Management platform, is vulnerable to an access control bypass where the introduction of a /tag/ declaration in the URL results in unauthorized page rendering. This occurs irrespective of existing group restrictions, exposing sensitive content. The issue has been addressed in versions 7.2.8, 7.3.13, and 7.4.6, and users are advised to upgrade to these versions to mitigate the risk.

Affected Version(s)

MasaCMS >= 7.4.0, < 7.4.6 < 7.4.0, 7.4.6

MasaCMS >= 7.3.0, < 7.3.13 < 7.3.0, 7.3.13

MasaCMS < 7.2.8 < 7.2.8

References

https://github.com/MasaCMS/MasaCMS/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/MasaCMS/MasaCMS/commit/d1a2e57ef8dbc50...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.