CVE-2024-32643

7.5 highEPSS 0.4%

High (7.5) in masacms masacms. EPSS 0.4% chance of exploitation in the next 30 days.

Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, if the URL to the page is modified to include a /tag/ declaration, the CMS will render the page regardless of group restrictions. This vulnerability is fixed in 7.2.8, 7.3.13, and 7.4.6.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 30% of CVEs (scores of 2026-10-31)
CWE: CWE-863
Published: 2025-12-03
Modified: 2026-09-26
Record from: the NVD, synced 2026-10-19

Affected

masacms:masacms

References

https://github.com/MasaCMS/MasaCMS/commit/d1a2e57ef8dbc50c87b178eacc85fcccb05f5b6c
https://github.com/MasaCMS/MasaCMS/security/advisories/GHSA-f469-jh82-97fv

Check your stack JSON