CVE-2025-55041 is a high-severity Cross-Site Request Forgery (CSRF) vulnerability affecting MuraCMS through version 10.1.10, specifically within its user management's "Add To Group" functionality. Rated 8.0 CVSS, this flaw allows an attacker to achieve privilege escalation (horizontal and vertical to admin groups, but not Super Admins) by tricking an authenticated administrator into visiting a crafted page, which then adds arbitrary users to groups due to a lack of CSRF token validation. This vulnerability carries a high impact on confidentiality, integrity, and availability. There is currently no evidence of active exploitation, public exploit code, or significant community attention for CVE-2025-55041.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:a:murasoftware:mura_cms:-:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.