Masa CMS is vulnerable to a host header poisoning attack that enables unauthenticated attackers to facilitate account takeover via malicious password reset emails.

This vulnerability arises from improper origin validation, specifically host header poisoning, which allows an unauthenticated attacker to manipulate the password reset mechanism. By poisoning the host header, an attacker can influence the reset link generated in emails, redirecting users to an attacker-controlled domain and intercepting sensitive recovery tokens.

The ability for an unauthenticated attacker to perform account takeover poses a severe threat to data confidentiality and integrity. With a CVSS score of 8.8, this high-severity vulnerability could lead to unauthorized access to administrative accounts, potential exfiltration of sensitive organizational data, and total compromise of user identity within the CMS environment.

Immediate Action: Upgrade Masa CMS instances to version 7.2.8, 7.3.13, or 7.4.6 as appropriate for your current release branch.

Proactive Monitoring: Review system logs for unusual password reset request patterns or anomalies in the HTTP Host header values received by the application server.

Compensating Controls: Implement strict HTTP Host header validation at the Web Application Firewall (WAF) or reverse proxy level to ensure only authorized hostnames are accepted by the application.

Public Exploit Available: No

Given the high CVSS score and the critical nature of account takeover vulnerabilities, this issue should be treated as a priority for remediation. Administrators must verify their current version and apply the vendor-provided patches immediately to prevent potential exploitation of the password recovery workflow.