CVE-2025-55041

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2025-55041", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-03-19T13:42:30.193Z", "dateReserved": "2025-08-06T00:00:00.000Z", "datePublished": "2026-03-18T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-18T15:41:38.839Z"}, "descriptions": [{"lang": "en", "value": "MuraCMS through 10.1.10 contains a CSRF vulnerability in the Add To Group functionality for user management (cUsers.cfc addToGroup method) that allows attackers to escalate privileges by adding any user to any group without proper authorization checks. The vulnerable function lacks CSRF token validation and directly processes user-supplied userId and groupId parameters via getUserManager().createUserInGorup(), enabling malicious websites to forge requests that automatically execute when an authenticated administrator visits a crafted page. Adding a user to the Super Admins group (s2 user) is not possible. Successful exploitation results in the attacker gaining privilege escalation both horizontally to other groups and vertically to the admin group. Escalation to the s2 User group is not possible."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://www.murasoftware.com"}, {"url": "https://docs.murasoftware.com/v10/release-notes/#section-version-1014"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-352", "lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-19T13:40:38.780752Z", "id": "CVE-2025-55041", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-19T13:42:30.193Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-55041", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-19T13:40:38.780752Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-19T13:42:24.149Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://www.murasoftware.com"}, {"url": "https://docs.murasoftware.com/v10/release-notes/#section-version-1014"}], "descriptions": [{"lang": "en", "value": "MuraCMS through 10.1.10 contains a CSRF vulnerability in the Add To Group functionality for user management (cUsers.cfc addToGroup method) that allows attackers to escalate privileges by adding any user to any group without proper authorization checks. The vulnerable function lacks CSRF token validation and directly processes user-supplied userId and groupId parameters via getUserManager().createUserInGorup(), enabling malicious websites to forge requests that automatically execute when an authenticated administrator visits a crafted page. Adding a user to the Super Admins group (s2 user) is not possible. Successful exploitation results in the attacker gaining privilege escalation both horizontally to other groups and vertically to the admin group. Escalation to the s2 User group is not possible."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-18T15:41:38.839Z"}}}, "cveMetadata": {"cveId": "CVE-2025-55041", "state": "PUBLISHED", "dateUpdated": "2026-03-19T13:42:30.193Z", "dateReserved": "2025-08-06T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-03-18T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:murasoftware:mura_cms:-:*:*:*:*:*:*:*", "matchCriteriaId": "CB4646EE-1255-4B42-890A-E0B57EBFE2CE", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "MuraCMS through 10.1.10 contains a CSRF vulnerability in the Add To Group functionality for user management (cUsers.cfc addToGroup method) that allows attackers to escalate privileges by adding any user to any group without proper authorization checks. The vulnerable function lacks CSRF token validation and directly processes user-supplied userId and groupId parameters via getUserManager().createUserInGorup(), enabling malicious websites to forge requests that automatically execute when an authenticated administrator visits a crafted page. Adding a user to the Super Admins group (s2 user) is not possible. Successful exploitation results in the attacker gaining privilege escalation both horizontally to other groups and vertically to the admin group. Escalation to the s2 User group is not possible."}, {"lang": "es", "value": "MuraCMS hasta 10.1.10 contiene una vulnerabilidad CSRF en la funcionalidad Add To Group para la gesti\u00f3n de usuarios (m\u00e9todo cUsers.cfc addToGroup) que permite a los atacantes escalar privilegios al a\u00f1adir cualquier usuario a cualquier grupo sin las comprobaciones de autorizaci\u00f3n adecuadas. La funci\u00f3n vulnerable carece de validaci\u00f3n de token CSRF y procesa directamente los par\u00e1metros userId y groupId proporcionados por el usuario a trav\u00e9s de getUserManager().createUserInGorup(), lo que permite a los sitios web maliciosos forjar solicitudes que se ejecutan autom\u00e1ticamente cuando un administrador autenticado visita una p\u00e1gina dise\u00f1ada. A\u00f1adir un usuario al grupo Super Admins (usuario s2) no es posible. La explotaci\u00f3n exitosa resulta en que el atacante obtiene una escalada de privilegios tanto horizontalmente a otros grupos como verticalmente al grupo de administradores. La escalada al grupo de usuarios s2 no es posible."}], "id": "CVE-2025-55041", "lastModified": "2026-06-17T09:41:09.330", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-55041", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-19T13:40:38.780752Z", "version": "2.0.3"}}]}, "published": "2026-03-18T16:16:23.303", "references": [{"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://docs.murasoftware.com/v10/release-notes/#section-version-1014"}, {"source": "cve@mitre.org", "tags": ["Product"], "url": "https://www.murasoftware.com"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,10.1.10]"}}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 98.0, "source": "matching"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "mura_cms", "vendor": "murasoftware"}], "analysis": {"en": {"generated_at": "2026-03-20T19:27:07.725044+00:00", "value": {"mitigation_remediation": ["Apply the latest MuraCMS patch (10.1.11 or newer) to eliminate the vulnerable Add To Group endpoint.", "Verify that all administrator accounts are using a version that includes the CSRF token validation fix.", "Restrict administrator access to secure, trusted networks and monitor for suspicious login activity.", "If an immediate patch is unavailable, limit the use of the Add To Group feature and consider disabling the endpoint until a fix is applied."], "summary": {"action": "Immediate Patch", "impact": "Privilege Escalation via CSRF"}, "threat_synthesis": {"affected_systems": "MuraCMS (murasoftware) versions up to and including 10.1.10 are affected. No other version or patch status is mentioned. Administrators using these versions should seek patch or upgrades.", "description_and_impact": "The flaw resides in the Add To Group function of MuraCMS, where the addToGroup method accepts userId and groupId parameters without validating a CSRF token. This omission lets a malicious actor craft a request that, when an authenticated administrator visits a specially designed webpage, automatically adds a target user to a chosen group, elevating the attacker\u2019s privileges. The vulnerability can raise the attacker from a regular user to another group, and further allow vertical escalation into the Admin group, though it cannot add users to the Super Admins group. The impact is a compromise of integrity and authorization controls, allowing attackers to impersonate users and gain administrative access.", "risk_and_exploitability": "The CVSS score of 8 indicates a high severity, but the EPSS score of less than 1% and absence from the KEV catalog suggest the exploit probability remains low at present. However, the attack requires an authenticated administrator to be tricked into loading a crafted page, making the threat primarily a cross-site request forgery scenario. The lack of CSRF checks means automated or remote exploitation is possible if an attacker can compromise a privileged user\u2019s session or persuade them to visit a malicious site. While the exploit path is straightforward, success depends on user behavior and the presence of an active session. The overall risk is considered high for systems that have not applied the vendor patch."}}}}, "created": "2026-03-19T08:57:11.452388+00:00", "title": "CSRF Privilege Escalation via Add To Group in MuraCMS", "updated": "2026-03-24T10:54:12.747323+00:00", "vendors": ["murasoftware", "murasoftware$PRODUCT$mura_cms"]}