Improper CSRF Protection in Masa CMS Leads to Data Loss
CVE-2026-40309
What is CVE-2026-40309?
Masa CMS suffers from a vulnerability where the cTrash.empty function fails to validate anti-CSRF tokens in versions 7.5.2 and earlier. This flaw allows malicious actors to exploit the system by tricking a logged-in administrator into submitting a forged request that empties the trash, leading to the irreversible deletion of crucial content. As a result, recovery of mistakenly deleted items becomes significantly challenging. To mitigate this risk, users are urged to upgrade to the latest versions (7.2.10, 7.3.15, 7.4.10, and 7.5.3), restrict access to the admin backend, employ browser isolation for admin sessions, and regularly back up their databases.
Affected Version(s)
MasaCMS < 7.2.10 < 7.2.10
MasaCMS >= 7.3.0, < 7.3.15 < 7.3.0, 7.3.15
MasaCMS >= 7.4.0, < 7.4.10 < 7.4.0, 7.4.10