CVE-2026-40174: Masa CMS CSRF in user address management allows unauthorized address changes
Masa CMS is a content management system forked from Mura CMS. In versions 7.5.2 and earlier, the cUsers.updateAddress function does not properly validate anti-CSRF tokens for user address management operations.
An attacker can induce a logged-in administrator to submit a forged request that adds, modifies, or deletes user address records, including email addresses and phone numbers. This can be used to alter contact information, redirect organizational communications, and corrupt address data in the user directory. This issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, restrict access to the administrative backend, use browser isolation for administrative sessions, or deploy filtering rules to block forged requests to the affected endpoint
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40174?
CVE-2026-40174 is classified as a high severity vulnerability due to its potential to allow unauthorized address changes.
How do I fix CVE-2026-40174?
To fix CVE-2026-40174, update Masa CMS to version 7.5.4 or later, where proper anti-CSRF token validation is implemented.
Who is affected by CVE-2026-40174?
CVE-2026-40174 affects users of Masa CMS versions 7.5.2 and earlier.
What type of attack does CVE-2026-40174 allow?
CVE-2026-40174 allows attackers to perform cross-site request forgery (CSRF) attacks on user address management.
Is there a known exploit for CVE-2026-40174?
While specific exploits are not publicly documented, the vulnerability's nature suggests that it could be easily exploited with the right conditions.