The vulnerability is a CSRF flaw in the content restoration feature of Masa CMS. Because the restoration endpoint does not validate anti‑CSRF tokens, an attacker can trick a logged‑in administrator into submitting a forged request that restores deleted items. Restored content can be placed at an attacker‑controlled location via the parentid parameter, allowing the attacker to re‑introduce previously removed malicious or outdated content, expose sensitive documents in publicly accessible locations, and disrupt the site structure or content integrity. This weakness corresponds to CWE‑352.

Affected product is MasaCMS MasaCMS. Versions 7.5.2 and earlier are vulnerable. The flaw was addressed in 7.2.10, 7.3.15, 7.4.10, and 7.5.3.

The exploit requires an administrator to be logged in and a forged request to be sent from a web browser. A separate phishing or social engineering attack may be used to coerce the admin into accepting the request. Because the vulnerability is not network‑bypassable and relies on victim interaction, the EPSS score is not available and the vulnerability is not listed in CISA KEV. Nevertheless, the CVSS score of 8.7 indicates a high severity, and the presence of the CSRF weakness suggests the vulnerability can be abused by attackers with access to the victim’s browser or via targeted phishing.