High · published December 3, 2025
⚡ Host header poisoning in Masa CMS could lead to some serious account hijacking chaos! 😱 Don't let an attacker swoop in while you're not looking! Think of it like sending a password reset link to the wrong address — the mailman trusts the sender and delivers it anyway, leaving your sensitive information wide open for anyone to grab! 📬 An attacker could exploit this vulnerability to take control of user accounts simply by manipulating the host header during a password reset request. If successful, they could lock users out of their accounts and gain unauthorized access to sensitive content — absolutely devastating! 🔥
Think of it like sending a password reset link to the wrong address — the mailman trusts the sender and delivers it anyway, leaving your sensitive information wide open for anyone to grab! 📬 This vulnerability in Masa CMS allows an attacker to poison the host header, enabling them to receive password reset emails intended for legitimate users, thus facilitating account takeover. It affects versions prior to 7.2.8, 7.3.13, and 7.4.6.
An attacker could exploit this vulnerability to take control of user accounts simply by manipulating the host header during a password reset request. If successful, they could lock users out of their accounts and gain unauthorized access to sensitive content — absolutely devastating! 🔥 Upgrade Masa CMS to versions 7.2.8, 7.3.13, or 7.4.6 immediately to patch this vulnerability. Additionally, consider implementing strict validation for host headers to prevent future attacks and enhance your overall security posture. You've got this! With a few updates, you can keep your CMS secure and your users safe! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| masacms/masacms | < 7.2.8 | 7.2.8 |
| masacms/masacms | ≥ 7.3, < 7.3.13 | 7.3.13 |
| masacms/masacms | ≥ 7.4.0, < 7.4.6 | 7.4.6 |