Masa CMS CSRF in trash management allows unauthorized permanent deletion of deleted content

Description

Masa CMS is a content management system forked from Mura CMS. In versions 7.5.2 and earlier, the cTrash.empty function does not validate anti-CSRF tokens for trash management requests. An attacker can induce a logged-in administrator to submit a forged request that empties the trash and permanently deletes all deleted content. This can cause irreversible data loss and disrupt recovery of content intended for restoration. This issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, restrict access to the administrative backend, use browser isolation for administrative sessions, and maintain current database backups to recover from unauthorized deletion.

Scores

EPSS (exploitation in 30 days)

0.17% · top 94% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.2.

Weakness

• CWE-352: Cross-Site Request Forgery (CSRF) (opens in a new tab)All about CWE-352 and its CVEs

Affected products

• MasaCMS · MasaCMS

  • affected < 7.2.10
  • affected >= 7.3.0, < 7.3.15
  • affected >= 7.4.0, < 7.4.10
  • affected >= 7.5.0, < 7.5.3

References (1)

• https://github.com/MasaCMS/MasaCMS/security/advisories/GHSA-9f35-q62j-vm5j (opens in a new tab)x_refsource_CONFIRM

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-40309](https://trackcve.app/badge/CVE-2026-40309.svg)](https://trackcve.app/cve/CVE-2026-40309)

Record last updated 7 May 2026, 13:54 UTC.