Vulnerability · Published Dec 3, 2025 · Assigned by GitHub_M

CVE-2024-32643Masa CMS vulnerable to authentication bypass with /tag/

High 7.5

In plain English

A high-severity incorrect authorization in MasaCMS from MasaCMS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.4%top 66.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, if the URL to the page is modified to include a /tag/ declaration, the CMS will render the page regardless of group restrictions. This vulnerability is fixed in 7.2.8, 7.3.13, and 7.4.6.

Affected products (as reported)

Vendor	Product	Versions
MasaCMS	MasaCMS	>= 7.4.0, < 7.4.6>= 7.3.0, < 7.3.13< 7.2.8

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/MasaCMS/MasaCMS/security/advisories/GHSA-f469-jh82-97fv x_refsource_CONFIRM
https://github.com/MasaCMS/MasaCMS/commit/d1a2e57ef8dbc50c87b178eacc85fcccb05f5b6c x_refsource_MISC