CVE-2026-40174
CSRF in Masa CMS Address Management
Publication date: 2026-05-06
Last updated on: 2026-05-06
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| masa_cms | masa_cms | to 7.5.3 (exc) |
| masa_cms | masa_cms | 7.2.10 |
| masa_cms | masa_cms | 7.3.15 |
| masa_cms | masa_cms | 7.4.10 |
| masa_cms | masa_cms | 7.5.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Masa CMS versions 7.5.2 and earlier, specifically in the cUsers.updateAddress function. The function does not properly validate anti-CSRF tokens during user address management operations.
As a result, an attacker can trick a logged-in administrator into submitting a forged request that can add, modify, or delete user address records, including email addresses and phone numbers.
This allows the attacker to alter contact information, redirect organizational communications, and corrupt address data in the user directory.
How can this vulnerability impact me? :
The vulnerability can impact you by allowing an attacker to manipulate user address records without proper authorization.
- Alteration of contact information such as email addresses and phone numbers.
- Redirection of organizational communications to unintended recipients.
- Corruption of address data in the user directory, potentially causing operational disruptions.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability immediately, you should restrict access to the administrative backend.
Use browser isolation for administrative sessions to prevent attackers from exploiting forged requests.
Deploy filtering rules to block forged requests targeting the affected endpoint related to user address management.
Additionally, update Masa CMS to one of the fixed versions: 7.2.10, 7.3.15, 7.4.10, or 7.5.3 as soon as possible.