CVE-2026-40309 Masa CMS CSRF in trash management allows unauthorized permanent deletion of deleted content
An attacker can trick an administrator into permanently deleting all trash content via a forged request, causing irreversible data loss.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-40309?
CVE-2026-40309 is a high-severity vulnerability in MasaCMS, published on 6 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Masa CMS is a content management system forked from Mura CMS. In versions 7.5.2 and earlier, the cTrash.empty function does not validate anti-CSRF tokens for trash management requests. An attacker can induce a logged-in administrator to submit a forged request that empties the trash and permanently deletes all deleted content. This can cause irreversible data loss and disrupt recovery of content intended for restoration. This issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, restrict access to the administrative backend, use browser isolation for administrative sessions, and maintain current database backups to recover from unauthorized deletion.
Weakness: CWE-352
Which versions are affected by CVE-2026-40309?
How do I fix CVE-2026-40309?
No fix has been published for CVE-2026-40309 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-40309 being exploited?
There is no known exploitation of CVE-2026-40309 in the wild and no public exploit code.
Sources
Also known as GHSA-9f35-q62j-vm5j.