Read the docs
TI-2026-29102 Aliases CVE-2026-40325

Masa CMS CSRF in content restoration allows unauthorized restoration of deleted content

Priority MEDIUM 45CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Tampering
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-352.

Summary

Masa CMS is a content management system forked from Mura CMS. In versions 7.5.2 and earlier, the `cTrash.restore` function does not properly validate anti-CSRF tokens for content restoration requests. An attacker can trick a logged-in administrator to submit a forged request that restores deleted items from the trash and places them at an attacker-controlled location in the site structure through the parentid parameter. This can restore previously deleted malicious or outdated content, expose sensitive documents by moving them into publicly accessible locations, and disrupt site structure or content integrity. This issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, restrict access to the administrative backend, use browser isolation for administrative sessions, and regularly empty the trash to reduce the amount of content available for unauthorized restoration.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00151 4th percentileScored 2026-11-07
Fix Fixed MasaCMS (MasaCMS): 7.2.10, 7.3.15, 7.4.10 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MasaCMSMasaCMSbefore 7.2.10; 7.3.0 to before 7.3.15; 7.4.0 to before 7.4.10; 7.5.0 to before 7.5.37.2.10, 7.3.15, 7.4.10, 7.5.3Patch availableCNA
  • MasaCMS VendorMasaCMS Affected before 7.2.10; 7.3.0 to before 7.3.15; 7.4.0 to before 7.4.10; 7.5.0 to before 7.5.3 Fixed in 7.2.10, 7.3.15, 7.4.10, 7.5.3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:masacms:masacms:*:*:*:*:*:*:*:*——MasaCMS
  • cpe:2.3:a:masacms:masacms:*:*:*:*:*:*:*:* Versions — — ·MasaCMS

Remediation

  • Fix · CNA MasaCMS (MasaCMS) Fixed in 7.2.10, 7.3.15, 7.4.10, 7.5.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40325

References

Other 1

  • TI-2024-21522 MasaCMS SQL Injection vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2024-21523 Masa CMS Vulnerable to Pre-Auth RCE via JSON API CVSS 3.1CRITICAL 9.8
  • TI-2024-21524 Host header poisoning allows account takeover via password reset email CVSS 3.1HIGH 8.8
  • TI-2024-21525 Masa CMS vulnerable to authentication bypass with /tag/ CVSS 3.1HIGH 7.5
  • TI-2022-23274 A vulnerability in the Remember Me function of Masa CMS v7.2, 7.3, and 7.4-beta allows… CVSS 3.1CRITICAL 9.8
  • TI-2026-29106 Masa CMS unauthenticated SQL injection via altTable parameter in JSON API CVSS 4.0CRITICAL 9.3
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences