Cross-Site Request Forgery in MuraCMS User Management by Mura Software

CVE-2025-55041

What is CVE-2025-55041?

MuraCMS, up to version 10.1.10, has a Cross-Site Request Forgery vulnerability in its user management's Add To Group feature. The lack of CSRF token validation allows attackers to manipulate user permissions by sending crafted requests that authenticate through an existing administrator session. This exploitation can lead to unauthorized privilege escalations across various user groups, enabling malicious actors to add users to unintended groups without consent. However, escalation to the Super Admins group (s2 user) remains restricted.

References