Read the docs
TI-2026-29086 Aliases CVE-2026-40309

Masa CMS CSRF in trash management allows unauthorized permanent deletion of deleted content

Priority LOW 39CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Tampering
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-352.

Summary

Masa CMS is a content management system forked from Mura CMS. In versions 7.5.2 and earlier, the cTrash.empty function does not validate anti-CSRF tokens for trash management requests. An attacker can induce a logged-in administrator to submit a forged request that empties the trash and permanently deletes all deleted content. This can cause irreversible data loss and disrupt recovery of content intended for restoration. This issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, restrict access to the administrative backend, use browser isolation for administrative sessions, and maintain current database backups to recover from unauthorized deletion.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00165 5th percentileScored 2026-11-07
Fix Fixed MasaCMS (MasaCMS): 7.2.10, 7.3.15, 7.4.10 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MasaCMSMasaCMSbefore 7.2.10; 7.3.0 to before 7.3.15; 7.4.0 to before 7.4.10; 7.5.0 to before 7.5.37.2.10, 7.3.15, 7.4.10, 7.5.3Patch availableCNA
  • MasaCMS VendorMasaCMS Affected before 7.2.10; 7.3.0 to before 7.3.15; 7.4.0 to before 7.4.10; 7.5.0 to before 7.5.3 Fixed in 7.2.10, 7.3.15, 7.4.10, 7.5.3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:masacms:masacms:*:*:*:*:*:*:*:*——MasaCMS
  • cpe:2.3:a:masacms:masacms:*:*:*:*:*:*:*:* Versions — — ·MasaCMS

Remediation

  • Fix · CNA MasaCMS (MasaCMS) Fixed in 7.2.10, 7.3.15, 7.4.10, 7.5.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40309

References

Other 1

  • TI-2024-21522 MasaCMS SQL Injection vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2024-21523 Masa CMS Vulnerable to Pre-Auth RCE via JSON API CVSS 3.1CRITICAL 9.8
  • TI-2024-21524 Host header poisoning allows account takeover via password reset email CVSS 3.1HIGH 8.8
  • TI-2024-21525 Masa CMS vulnerable to authentication bypass with /tag/ CVSS 3.1HIGH 7.5
  • TI-2022-23274 A vulnerability in the Remember Me function of Masa CMS v7.2, 7.3, and 7.4-beta allows… CVSS 3.1CRITICAL 9.8
  • TI-2026-29106 Masa CMS unauthenticated SQL injection via altTable parameter in JSON API CVSS 4.0CRITICAL 9.3
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences