A critical cross-site request forgery vulnerability in MuraCMS allows authenticated users to achieve unauthorized privilege escalation by manipulating group memberships.

The vulnerability exists in the cUsers.cfc component, specifically within the addToGroup method, which lacks CSRF token validation. An attacker can craft a malicious page that, when visited by an authenticated administrator, forces the application to add users to groups without authorization.

The ability for an attacker to escalate privileges poses a severe risk to the integrity and security of the entire CMS environment. Successful exploitation could allow unauthorized users to gain administrative control over the platform, leading to potential data exfiltration, system configuration changes, and unauthorized content management. With a CVSS score of 8.0, this high-severity flaw requires immediate attention to prevent internal system compromise.

Immediate Action: Update MuraCMS to version 10.1.14 or later, as documented in the vendor release notes, to implement the necessary CSRF token validation.

Proactive Monitoring: Review web server and application access logs for unusual patterns of administrative activity or unexpected requests to the cUsers.cfc component.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block suspicious cross-site requests and enforce strict referer header checks for administrative endpoints.

Public Exploit Available: Unknown

Given the high-severity nature of this privilege escalation flaw, administrators must prioritize the update to the latest version of MuraCMS. Failure to apply the vendor-provided patch leaves the administrative interface vulnerable to CSRF-based attacks, which can be executed silently via a simple user interaction. Patching should be performed during the next available maintenance window to ensure the security of user management functions.