The flaw resides in the Add To Group function of MuraCMS, where the addToGroup method accepts userId and groupId parameters without validating a CSRF token. This omission lets a malicious actor craft a request that, when an authenticated administrator visits a specially designed webpage, automatically adds a target user to a chosen group, elevating the attacker’s privileges. The vulnerability can raise the attacker from a regular user to another group, and further allow vertical escalation into the Admin group, though it cannot add users to the Super Admins group. The impact is a compromise of integrity and authorization controls, allowing attackers to impersonate users and gain administrative access.

MuraCMS (murasoftware) versions up to and including 10.1.10 are affected. No other version or patch status is mentioned. Administrators using these versions should seek patch or upgrades.

The CVSS score of 8 indicates a high severity, but the EPSS score of less than 1% and absence from the KEV catalog suggest the exploit probability remains low at present. However, the attack requires an authenticated administrator to be tricked into loading a crafted page, making the threat primarily a cross-site request forgery scenario. The lack of CSRF checks means automated or remote exploitation is possible if an attacker can compromise a privileged user’s session or persuade them to visit a malicious site. While the exploit path is straightforward, success depends on user behavior and the presence of an active session. The overall risk is considered high for systems that have not applied the vendor patch.