Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Masa CMS is a content management system forked from Mura CMS. In versions 7.5.2 and earlier, the cUsers.updateAddress function does not properly validate anti-CSRF tokens for user address management operations. An attacker can induce a logged-in administrator to submit a forged request that adds, modifies, or deletes user address records, including email addresses and phone numbers. This can be used to alter contact information, redirect organizational communications, and corrupt address data in the user directory. This issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, restrict access to the administrative backend, use browser isolation for administrative sessions, or deploy filtering rules to block forged requests to the affected endpoint
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-40174 Masa CMS is a content management system forked from Mura CMS. In versions 7.5.2 and earlier, the cUsers.updateAddress function does not properly validate anti-CSRF to… https://www.cve.org/CVERecord?id=CVE-2026-40174
Post summary
The text announces a CVE (2026-40174) describing a CSRF validation flaw in Masa CMS without any evidence of exploitation, tools, or patches.
CVE-2026-40174 Cross-Site Request Forgery in Masa CMS User Address Management Below 7.5.3 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40174
Post summary
The note references a CSRF flaw in Masa CMS (versions <7.5.3) and links to a Vulmon page, but provides no PoC, exploitation details, or patch information.