CVE-2026-40325: Masa CMS CSRF Vulnerability

CVE-2026-40325 Overview

CVE-2026-40325 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in Masa CMS, a content management system forked from Mura CMS. The flaw exists in the cTrash.restore function, which fails to validate anti-CSRF tokens on content restoration requests. Affected versions include Masa CMS 7.5.2 and earlier. An attacker who tricks an authenticated administrator into visiting a malicious page can restore deleted content and reposition it anywhere in the site structure using the parentid parameter. The vendor released fixes in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3.

Critical Impact

Attackers can resurrect previously deleted malicious or sensitive content and place it in publicly accessible site locations, undermining content integrity and potentially exposing confidential documents.

Affected Products

• Masa CMS versions 7.5.2 and earlier (7.5.x branch)
• Masa CMS 7.4.x prior to 7.4.10
• Masa CMS 7.3.x prior to 7.3.15 and 7.2.x prior to 7.2.10

Discovery Timeline

• 2026-05-06 - CVE-2026-40325 published to NVD
• 2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-40325

Vulnerability Analysis

The vulnerability resides in the cTrash.restore handler within Masa CMS. This function processes administrative requests to restore items from the trash but omits validation of anti-CSRF tokens. As a result, the server accepts state-changing restoration requests based solely on the administrator's session cookie. An attacker can craft a malicious page or email that triggers a forged HTTP request to the Masa CMS administrative endpoint. When a logged-in administrator interacts with the attacker-controlled content, the browser submits the forged request with valid session credentials.

The parentid parameter accepted by cTrash.restore controls where the restored item is placed in the site tree. This allows the attacker to relocate restored content to any node, including publicly accessible sections of the site.

Root Cause

The root cause is missing CSRF token validation [CWE-352] on a state-changing administrative endpoint. The cTrash.restore function relies on session authentication alone and does not verify a synchronizer token, double-submit cookie, or equivalent origin-based control. This omission diverges from the CSRF protections applied elsewhere in the administrative backend.

Attack Vector

Exploitation requires a network-reachable Masa CMS instance and user interaction from an authenticated administrator. The attacker hosts a page containing an auto-submitting form or image tag pointing at the vulnerable endpoint. When the administrator visits the page in the same browser session as the CMS, the request executes with administrative privileges. The attacker selects which trashed item to restore and supplies a parentid value that places the content in a high-visibility location, such as the site root or a public navigation branch. See the GitHub Security Advisory for vendor technical details.

Detection Methods for CVE-2026-40325

Indicators of Compromise

• Web server access logs showing requests to cTrash.restore originating from off-site Referer headers or with no Referer header set.
• Unexpected reappearance of previously deleted content nodes in the site structure or public navigation.
• Audit log entries recording trash restoration events outside of normal administrator workflows or business hours.

Detection Strategies

• Inspect HTTP request logs for POST or GET requests to the cTrash.restore endpoint that include a parentid parameter and originate from external referrers.
• Compare current published content against backup snapshots to identify restored items that should remain deleted.
• Review CMS administrator session activity for restoration actions that do not correlate with legitimate administrator browser sessions.

Monitoring Recommendations

• Enable verbose audit logging for all trash and content lifecycle operations within Masa CMS.
• Forward web server and application logs to a centralized SIEM and alert on anomalous restoration patterns.
• Monitor administrator account activity for requests issued from unusual user agents, IP addresses, or geolocations.

How to Mitigate CVE-2026-40325

Immediate Actions Required

• Upgrade Masa CMS to a fixed release: 7.2.10, 7.3.15, 7.4.10, or 7.5.3, depending on your branch.
• Audit the trash and recently restored content for unauthorized items and remove or re-delete them as appropriate.
• Force re-authentication of administrator sessions and rotate any credentials that may have been used while the system was vulnerable.

Patch Information

The Masa CMS maintainers fixed CVE-2026-40325 in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. The patch adds anti-CSRF token validation to the cTrash.restore function. Refer to the GitHub Security Advisory GHSA-3mpf-gq73-crxf for release notes and commit details.

Workarounds

• Restrict access to the Masa CMS administrative backend by IP allowlist or VPN until patches are applied.
• Use a dedicated browser or browser isolation profile for administrative sessions to prevent cross-origin request abuse.
• Empty the trash on a regular schedule to minimize the volume of content available for unauthorized restoration.
• Require administrators to log out of the CMS when not actively performing administrative tasks.