CVE-2026-40326: Masa CMS CSRF Vulnerability

CVE-2026-40326 Overview

CVE-2026-40326 is a Cross-Site Request Forgery [CWE-352] vulnerability in Masa CMS, a content management system forked from Mura CMS. The flaw exists in the createBundle method within csettings.cfc, which fails to validate anti-CSRF tokens for site bundle creation requests. An attacker can craft a malicious page or link that, when visited by an authenticated administrator, silently triggers creation of a comprehensive site bundle. The bundle is written to a predictable, publicly accessible web directory. An unauthenticated attacker can then download it. Versions 7.5.2 and earlier are affected.

Critical Impact

Successful exploitation discloses site content, user account data, password hashes, form submissions, email lists, plugins, and configuration data to an unauthenticated attacker.

Affected Products

• Masa CMS versions 7.5.2 and earlier
• Masa CMS 7.4.x prior to 7.4.10
• Masa CMS 7.3.x prior to 7.3.15 and 7.2.x prior to 7.2.10

Discovery Timeline

• 2026-05-06 - CVE-2026-40326 published to NVD
• 2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-40326

Vulnerability Analysis

The vulnerability resides in the createBundle action in csettings.cfc. The handler accepts authenticated POST requests to generate a complete site bundle but does not enforce anti-CSRF token validation. Because the request relies solely on the administrator's session cookie, any cross-origin request issued while the admin is logged in executes with full administrative authority.

The generated bundle aggregates sensitive artifacts from the application: rendered site content, user records with password hashes, captured form submissions, mailing lists, installed plugins, and configuration files. The bundle is written to a deterministic path under a publicly served web directory, removing the need for authentication during retrieval. This separates exploitation into two stages: trigger via CSRF and data exfiltration via direct HTTP GET.

Root Cause

The root cause is missing CSRF protection on a state-changing administrative endpoint, classified under [CWE-352]. The application relies on ambient session authentication without binding requests to a per-session token or verifying the Origin and Referer headers. A secondary design flaw amplifies impact: the resulting archive is stored in a predictable, web-accessible location rather than an authenticated download path or a non-public file store.

Attack Vector

Exploitation requires an authenticated administrator to load attacker-controlled content (such as a malicious page, email link, or embedded image) while an active admin session exists. The browser issues a forged request to the Masa CMS createBundle endpoint, which produces the bundle on disk. The attacker then fetches the predictable URL anonymously to retrieve all included secrets. User interaction is required, but no privileges are needed for the final retrieval step.

No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-622v-h7vf-w4gm for technical details.

Detection Methods for CVE-2026-40326

Indicators of Compromise

• Unexpected bundle archive files appearing in publicly accessible web directories used by Masa CMS.
• HTTP POST requests to the createBundle endpoint in csettings.cfc originating from cross-site Referer headers or unfamiliar origins.
• Unauthenticated GET requests retrieving bundle files from external IP addresses shortly after an administrator session was active.

Detection Strategies

• Inspect web server access logs for POST requests to administrative endpoints in csettings.cfc lacking expected CSRF token parameters.
• Hunt for sequences where an admin POST is followed by anonymous downloads of large archives from the same host.
• Compare directory listings of public bundle paths against an authorized baseline to identify unauthorized artifacts.

Monitoring Recommendations

• Alert on creation of archive files (.zip, .tar, bundle extensions) within Masa CMS web roots outside of approved deployment windows.
• Monitor outbound bandwidth spikes from the CMS host that correlate with newly written bundle files.
• Forward CMS audit logs to a centralized SIEM and apply correlation rules tying admin sessions to bundle generation events.

How to Mitigate CVE-2026-40326

Immediate Actions Required

• Upgrade Masa CMS to a fixed release: 7.2.10, 7.3.15, 7.4.10, or 7.5.3.
• Remove any unexpected bundle files currently present in publicly accessible directories.
• Rotate administrator credentials, API keys, and any secrets stored in CMS configuration after confirming exposure.

Patch Information

The vendor fixed the vulnerability in Masa CMS versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. The patches add anti-CSRF token validation to the createBundle method in csettings.cfc. See the GitHub Security Advisory GHSA-622v-h7vf-w4gm for upgrade instructions.

Workarounds

• Restrict network access to the affected administrative endpoint using web server ACLs or a WAF rule blocking unauthenticated createBundle requests.
• Limit administrative session exposure by enforcing short session timeouts and isolating admin browsing in a dedicated browser profile.
• Block public HTTP access to bundle output directories via web server configuration until upgrade is complete.

# Example nginx configuration to block public access to bundle output paths
location ~* /(bundles|export)/ {
    deny all;
    return 403;
}

# Restrict createBundle endpoint to internal admin network
location ~* /admin/.*csettings\.cfc {
    allow 10.0.0.0/8;
    deny all;
}