Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Masa CMS is a content management system forked from Mura CMS. In versions 7.5.2 and earlier, the cTrash.empty function does not validate anti-CSRF tokens for trash management requests. An attacker can induce a logged-in administrator to submit a forged request that empties the trash and permanently deletes all deleted content. This can cause irreversible data loss and disrupt recovery of content intended for restoration. This issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, restrict access to the administrative backend, use browser isolation for administrative sessions, and maintain current database backups to recover from unauthorized deletion.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-40309 Masa CMS is a content management system forked from Mura CMS. In versions 7.5.2 and earlier, the cTrash.empty function does not validate anti-CSRF tokens for trash ma… https://www.cve.org/CVERecord?id=CVE-2026-40309
Post summary
The post discloses a CSRF weakness in Masa CMS’s cTrash.empty function for versions 7.5.2 and earlier, without providing any PoC, exploit, or mitigation details.
CVE-2026-40309 Cross-Site Request Forgery in Masa CMS Versions 7.5.2 and Earlier https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40309
Post summary
The text announces CVE-2026-40309 as a CSRF flaw affecting Masa CMS 7.5.2 and earlier, providing a link to a vulnerability database page but no PoC, exploit, patch, or evidence of active exploitation.