An authorization bypass vulnerability in Masa CMS allows unauthenticated attackers to access restricted content by manipulating page URLs.

This is an incorrect authorization flaw (CWE-863) where the application fails to validate user permissions when a specific URL pattern (/tag/) is utilized. The vulnerability is accessible to unauthenticated remote attackers.

Successful exploitation permits unauthorized users to view sensitive or protected content that should be restricted based on group permissions. With a CVSS score of 7.5, this high-severity flaw poses a significant risk to data confidentiality, potentially leading to unauthorized information disclosure and loss of administrative control over access policies.

Immediate Action: Update Masa CMS to versions 7.2.8, 7.3.13, or 7.4.6, depending on your current deployment branch, to apply the necessary authorization checks.

Proactive Monitoring: Review web server access logs for anomalous requests containing the /tag/ string, particularly those originating from unauthorized or external IP addresses.

Compensating Controls: Implement WAF rules to inspect and filter incoming HTTP requests that contain the /tag/ directory structure if immediate patching is not feasible.

Public Exploit Available: No (Exploit status is unknown; no confirmed public exploit exists in the provided data).

Given the high-severity nature of this authorization bypass, organizations must prioritize upgrading their Masa CMS instances to the patched versions immediately. Failure to address this vulnerability allows attackers to bypass core security controls, leading to potential data exposure. Ensure that all affected production environments are updated and verified against the fixed version strings provided.