CVE Intelligence
Analysis AI-assisted

CVE-2026-40331: Masa CMS SQL Injection via Unauthenticated JSON API altTable Parameter

Masa CMS contains an unauthenticated SQL injection in the JSON API altTable parameter, which is placed into a SQL FROM clause without validation. The record rates it critical with a CVSS 4.0 score of 9.3 from the GitHub CNA. Fixed versions are listed as 7.2.10, 7.3.15, 7.4.10 and 7.5.3, and the interim workaround is input validation or disabling the JSON API.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Masa CMS is an open source content management system. The advisory describes an SQL injection (CWE-89) in its unauthenticated JSON API. The altTable parameter is stored by the setAltTable() method and placed into a SQL FROM clause in feedGateway.cfc without validation or sanitization.

Impact

  • According to the advisory, an unauthenticated remote attacker could read data from any table in the database in a single HTTP request, including administrative credentials and password reset tokens.
  • The CVSS 4.0 vector in the record indicates network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability. The score of 9.3 is attributed to the GitHub CNA.
  • Inference: if credentials or reset tokens are exposed, account takeover on affected installations becomes a realistic concern.

Affected products and versions

  • Masa CMS 7.2.0 through 7.2.9
  • Masa CMS 7.3.0 through 7.3.14
  • Masa CMS 7.4.0 through 7.4.9
  • Masa CMS 7.5.0 through 7.5.2

The structured affected and fixes fields in the record are empty, so these ranges come from the description text. Confirm them against the GitHub advisory.

Exploitation status

The record shows this CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted. The record lists an EPSS probability of 0.00536 and a percentile of 0.43645.

Remediation and mitigation

  • Upgrade to 7.2.10, 7.3.15, 7.4.10 or 7.5.3, matching your release line.
  • If an upgrade cannot happen immediately, the advisory suggests restricting the setAltTable function in core/mura/content/feed/feedBean.cfc to simple alphanumeric table names, or disabling the JSON API if it is not required.
  • Limit exposure of the JSON API at the network or application perimeter where practical.

Detection guidance

  • Review web server and application logs for requests to the JSON API that include an altTable parameter, especially with unusual values or repeated errors.
  • Review database logs for unexpected reads of user or token data.
  • If exposure is suspected, rotating administrative passwords and invalidating outstanding password reset tokens is a reasonable precaution. This is an inference, not guidance stated in the record.

Limitations of the available information

  • The record has no structured affected or fixed version data, so version information comes from the description.
  • Patch contents, exploitation prevalence and whether earlier releases are affected are not covered by the sources consulted.
  • The EPSS date in the record (2026-10-13) is later than the publication date and should be verified.
  • The source status is recorded as Deferred. Check the vendor advisory for current remediation details.

Frequently asked questions

Is this vulnerability being actively exploited?

The record does not list this CVE in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

Which versions contain the fix?

The advisory text lists fixes in 7.2.10, 7.3.15, 7.4.10 and 7.5.3 for the corresponding release lines.

What can I do if I cannot upgrade right away?

The advisory suggests restricting input in setAltTable to simple table names, or disabling the JSON API if it is not required.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.