Read the docs
TI-2026-28988 Aliases CVE-2026-40174

Masa CMS CSRF in user address management allows unauthorized address changes

Priority LOW 30CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Tampering
Confidentiality · integrity · availability
Low · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-352.

Summary

Masa CMS is a content management system forked from Mura CMS. In versions 7.5.2 and earlier, the cUsers.updateAddress function does not properly validate anti-CSRF tokens for user address management operations. An attacker can induce a logged-in administrator to submit a forged request that adds, modifies, or deletes user address records, including email addresses and phone numbers. This can be used to alter contact information, redirect organizational communications, and corrupt address data in the user directory. This issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, restrict access to the administrative backend, use browser isolation for administrative sessions, or deploy filtering rules to block forged requests to the affected endpoint

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00165 5th percentileScored 2026-11-07
Fix Fixed MasaCMS (MasaCMS): 7.2.10, 7.3.15, 7.4.10 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MasaCMSMasaCMSbefore 7.2.10; 7.3.0 to before 7.3.15; 7.4.0 to before 7.4.10; 7.5.0 to before 7.5.37.2.10, 7.3.15, 7.4.10, 7.5.3Patch availableCNA
  • MasaCMS VendorMasaCMS Affected before 7.2.10; 7.3.0 to before 7.3.15; 7.4.0 to before 7.4.10; 7.5.0 to before 7.5.3 Fixed in 7.2.10, 7.3.15, 7.4.10, 7.5.3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:masacms:masacms:*:*:*:*:*:*:*:*——MasaCMS
  • cpe:2.3:a:masacms:masacms:*:*:*:*:*:*:*:* Versions — — ·MasaCMS

Remediation

  • Fix · CNA MasaCMS (MasaCMS) Fixed in 7.2.10, 7.3.15, 7.4.10, 7.5.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40174

References

Other 1

  • TI-2024-21522 MasaCMS SQL Injection vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2024-21523 Masa CMS Vulnerable to Pre-Auth RCE via JSON API CVSS 3.1CRITICAL 9.8
  • TI-2024-21524 Host header poisoning allows account takeover via password reset email CVSS 3.1HIGH 8.8
  • TI-2024-21525 Masa CMS vulnerable to authentication bypass with /tag/ CVSS 3.1HIGH 7.5
  • TI-2022-23274 A vulnerability in the Remember Me function of Masa CMS v7.2, 7.3, and 7.4-beta allows… CVSS 3.1CRITICAL 9.8
  • TI-2026-29106 Masa CMS unauthenticated SQL injection via altTable parameter in JSON API CVSS 4.0CRITICAL 9.3
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences