CVE-2026-40309: high-severity vulnerability in MasaCMS
Masa CMS CSRF in trash management allows unauthorized permanent deletion of deleted content
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.2epss 0.2%
Masa CMS is a content management system forked from Mura CMS. In versions 7.5.2 and earlier, the cTrash.empty function does not validate anti-CSRF tokens for trash management requests. An attacker can induce a logged-in administrator to submit a forged request that empties the trash and permanently deletes all deleted content. This can cause irreversible data loss and disrupt recovery of content intended for restoration. This issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, restrict access to the administrative backend, use browser isolation for administrative sessions, and maintain current database backups to recover from unauthorized deletion.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
MasaCMS · MasaCMSRelated CVEs — MasaCMS
In the same product, most dangerous first.
CVE-2024-32640CRITICALMasaCMS SQL Injection vulnerabilityEPSS 78.4%CVE-2024-32641CRITICALMasa CMS Vulnerable to Pre-Auth RCE via JSON APIEPSS 13.1%CVE-2026-40330CRITICALMasa CMS SQL injection via sortDirection parameter in beanFeedEPSS 0.4%CVE-2024-32643HIGHMasa CMS vulnerable to authentication bypass with /tag/EPSS 0.4%CVE-2026-40332MEDIUMMasa CMS open redirect via improper handling of scheme-relative URLsEPSS 0.3%CVE-2026-40331CRITICALMasa CMS unauthenticated SQL injection via altTable parameter in JSON APIEPSS 0.3%