CVE-2026-40326: 
MasaCMS vulnerability analysis and mitigation

CVE-2026-40326 is a Cross-Site Request Forgery (CSRF) vulnerability in Masa CMS's site bundle creation functionality, affecting versions 7.5.2 and earlier. The flaw resides in the createBundle method within csettings.cfc, which fails to properly validate anti-CSRF tokens, allowing an attacker to silently trigger the creation of a full site backup when a logged-in administrator visits a malicious page. The resulting bundle is stored in a predictable, publicly accessible directory, enabling unauthenticated retrieval of sensitive data. Fixed versions are 7.2.10, 7.3.15, 7.4.10, and 7.5.3. The vulnerability carries a CVSS v4.0 base score of 7.1 (High) and a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Feedly).

The root cause is CWE-352 (Cross-Site Request Forgery): the createBundle method in csettings.cfc does not enforce anti-CSRF token validation on site bundle creation requests, a flaw inherited from the upstream Mura CMS codebase. An attacker crafts a malicious webpage or link that, when visited by an authenticated administrator, silently issues a POST request to the vulnerable endpoint, triggering bundle generation without the administrator's knowledge. The generated bundle is written to a predictable, publicly accessible web directory (e.g., /assets/, /bundles/, or /temp/), from which any unauthenticated party can download it. No special privileges are required by the attacker — only passive user interaction from a logged-in administrator is needed (GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to exfiltrate a comprehensive site bundle containing user account data, password hashes, form submissions, email lists, installed plugins, all site content, and internal configuration settings and keys. Because the bundle creation occurs silently in the background, administrators may be entirely unaware that a full backup of their site has been generated and downloaded by an external party. The primary impact is high confidentiality loss; integrity and availability are not directly affected by this vulnerability (GitHub Advisory, Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.025% (0.000250), indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only that an administrator visit a malicious link or page while authenticated, making social engineering the primary attack vector (GitHub Advisory, Feedly).

1. Reconnaissance: Identify a target Masa CMS instance running version 7.5.2 or earlier. Confirm the presence of the csettings.cfc endpoint and that the site is not behind a WAF blocking cross-origin POST requests.
2. Craft malicious page: Create an HTML page containing a hidden form or JavaScript that automatically submits a POST request to the target's csettings.cfc endpoint invoking the createBundle method, without any CSRF token.
3. Deliver to administrator: Send the malicious link or embed the page in content likely to be visited by a logged-in Masa CMS administrator (e.g., via phishing email, forum post, or injected content).
4. Trigger bundle creation: When the administrator visits the page while authenticated, their browser silently submits the forged request. The CMS processes it without CSRF validation and generates a full site bundle.
5. Retrieve the bundle: The bundle is saved to a predictable, publicly accessible directory (e.g., /assets/, /bundles/, or /temp/). The attacker directly downloads the .zip bundle file via an unauthenticated HTTP GET request.
6. Extract sensitive data: Open the bundle to access user accounts, password hashes, form submissions, email lists, plugins, site content, and configuration data for further exploitation (e.g., credential cracking, targeted phishing) (GitHub Advisory).

• Network: Unexpected POST requests to csettings.cfc originating from unusual referer headers or cross-origin sources; unauthenticated GET requests downloading .zip files from /assets/, /bundles/, or /temp/ directories shortly after an administrator session.
• File System: Presence of unexpected .zip or bundle archive files in publicly accessible web directories such as /assets/, /bundles/, or /temp/; file creation timestamps on bundle files that do not correspond to scheduled or administrator-initiated backup activity.
• Logs: Web server access logs showing POST requests to csettings.cfc with missing, empty, or invalid Origin/Referer headers; subsequent GET requests to bundle file paths from external IP addresses not associated with administrative users (GitHub Advisory).

Masa CMS has released patched versions addressing this vulnerability: upgrade to 7.2.10, 7.3.15, 7.4.10, or 7.5.3 depending on your branch. If an immediate upgrade is not possible, the following workarounds are recommended: periodically audit and delete unexpected .zip or bundle files from public directories (/assets/, /bundles/, /temp/); deploy WAF rules to block or alert on POST requests to csettings.cfc lacking valid Origin or Referer headers; ensure administrators log out when not actively using the CMS and avoid clicking unknown links during active sessions; and consider temporarily renaming or restricting access to csettings.cfc if site bundling is not routinely required (GitHub Advisory).

The advisory was published by Masa CMS maintainer guustnieuwenhuis on GitHub on April 30, 2026, and assigned CVE-2026-40326. No notable independent researcher commentary, media coverage, or significant social media discussion has been identified beyond standard vulnerability database indexing (GitHub Advisory).