What is the CVSS score of CVE-2024-32643?

CVE-2024-32643 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Masacms are affected by CVE-2024-32643?

Masa CMS installations are vulnerable to unauthorized content access through a URL manipulation technique that bypasses group-based access restrictions.. A patch is available.

Is there a public PoC exploit available for CVE-2024-32643?

Yes, a public proof-of-concept exploit is available for CVE-2024-32643. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2024-32643?

Within 24 hours: Inventory all Masa CMS instances and identify affected versions. Within 7 days: Apply vendor patches (upgrade to 7.2.8, 7.3.13, or 7.4.6) to all instances or implement compensating controls if patching is delayed. Within 30 days: Conduct access logs review for suspicious /tag/ URL patterns and validate that all systems are patched and running supported versions.

Masacms CVE-2024-32643

EUVD-2024-30445 HIGH

Incorrect Authorization (CWE-863)

2025-12-03 security-advisories@github.com

Authentication Bypass Masacms

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 16:14 euvd

EUVD-2024-30445

Analysis Generated

Mar 15, 2026 - 16:14 vuln.today

Patch released

Mar 15, 2026 - 16:14 nvd

Patch available

PoC Detected

Dec 05, 2025 - 15:37 vuln.today

Public exploit code

CVE Published

Dec 03, 2025 - 17:15 nvd

HIGH 7.5

DescriptionGitHub Advisory

Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, if the URL to the page is modified to include a /tag/ declaration, the CMS will render the page regardless of group restrictions. This vulnerability is fixed in 7.2.8, 7.3.13, and 7.4.6.

Analysis

Technical ContextAI

This vulnerability is classified as Incorrect Authorization (CWE-863).

RemediationAI

A vendor patch is available. Apply it as soon as possible and verify the fix.

CVE-2024-32643 vulnerability details – vuln.today

Back

Masacms CVE-2024-32643

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

Analysis

Technical ContextAI

RemediationAI

Share

External POC / Exploit Code