CVE-2026-40174: 
MasaCMS vulnerability analysis and mitigation

CVE-2026-40174 is a Cross-Site Request Forgery (CSRF) vulnerability in Masa CMS affecting the user address management functionality. It exists in the cUsers.updateAddress function, which fails to properly validate anti-CSRF tokens, allowing an attacker to forge requests on behalf of a logged-in administrator. Affected versions are 7.5.2 and earlier across the 7.2, 7.3, 7.4, and 7.5 release lines. The vulnerability was published on May 6, 2026, with the GitHub Security Advisory (GHSA-572m-p246-4356) published April 30, 2026. It carries a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory, Feedly).

The root cause is improper CSRF token validation (CWE-352) in the cUsers.updateAddress function of Masa CMS, a flaw inherited from the upstream Mura CMS codebase. An attacker crafts a malicious webpage that, when visited by a logged-in administrator, silently submits a forged HTTP POST request to the cUsers.cfc endpoint, bypassing CSRF protections entirely. Exploitation requires no privileges from the attacker but does require passive user interaction — specifically, an authenticated administrator visiting the attacker-controlled page. The attack vector is network-based with low complexity and no special attack requirements (GitHub Advisory).

Successful exploitation allows an attacker to add, modify, or delete user address records — including email addresses and phone numbers — without the administrator's knowledge or consent. This can redirect sensitive organizational communications to attacker-controlled locations, facilitate social engineering attacks by injecting malicious contact data, and corrupt the internal user directory, disrupting legitimate business correspondence. While availability is not directly impacted, the integrity impact is rated High and there is a low confidentiality impact, as the attacker may gain visibility into address data structures (GitHub Advisory, Feedly).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2026-40174 as of the available data. The EPSS score is approximately 0.019% (0.000190), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (Feedly).

1. Reconnaissance: Identify a target Masa CMS instance running version 7.5.2 or earlier. Confirm the version via publicly accessible metadata, HTTP headers, or CMS-specific paths.
2. Identify the target endpoint: Determine the URL of the cUsers.cfc component responsible for address management (e.g., /index.cfm?component=cUsers&method=updateAddress or equivalent).
3. Craft a malicious HTML page: Create a webpage containing a hidden HTML form that auto-submits a POST request to the target cUsers.updateAddress endpoint with attacker-controlled address fields (e.g., modified email address, phone number).
4. Deliver the payload: Trick a logged-in Masa CMS administrator into visiting the malicious page via phishing email, social engineering, or a compromised third-party site.
5. Forged request executes: The administrator's browser automatically submits the forged form using their active session cookies. Because the server does not validate the CSRF token, the request is accepted and the user address record is modified, deleted, or a new one is added.
6. Achieve objective: The attacker's chosen contact data (e.g., a redirected email address) is now stored in the CMS user directory, enabling communication interception or further social engineering (GitHub Advisory).

• Network: Unexpected POST requests to the cUsers.cfc endpoint (e.g., /index.cfm?component=cUsers&method=updateAddress) originating from external or unusual referrer domains; requests lacking a valid same-origin Referer header.
• Logs: CMS access logs showing address update operations (updateAddress) performed during unusual hours or from IP addresses not associated with known administrators; multiple rapid address changes in a short timeframe.
• Application Data: Unexpected changes to administrator or user contact records, particularly email addresses or phone numbers altered to unknown external addresses; new address records added without corresponding administrator activity.
• Session: Administrative actions performed from browser sessions that were not initiated from trusted IP ranges or VPN endpoints (GitHub Advisory).

Masa CMS has released patched versions that implement mandatory CSRF token validation for all address-related operations. Users should upgrade immediately to the appropriate version for their release line: 7.2.10, 7.3.15, 7.4.10, or 7.5.3. If an immediate upgrade is not feasible, recommended workarounds include: restricting administrative backend access to trusted IP addresses or via VPN; configuring WAF rules to block POST requests to the cUsers.cfc endpoint lacking a valid same-origin Referer header; using a dedicated or isolated browser session exclusively for CMS administration; and ensuring administrators log out immediately after completing administrative tasks (GitHub Advisory).