CVE-2026-40331
SQL Injection in Masa CMS via Unauthenticated JSON API
Publication date: 2026-05-05
Last updated on: 2026-05-05
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| masa | cms | From 7.2.0 (inc) to 7.2.9 (inc) |
| masa | cms | From 7.3.0 (inc) to 7.3.14 (inc) |
| masa | cms | From 7.4.0 (inc) to 7.4.9 (inc) |
| masa | cms | From 7.5.0 (inc) to 7.5.2 (inc) |
| masa | cms | 7.2.10 |
| masa | cms | 7.3.15 |
| masa | cms | 7.4.10 |
| masa | cms | 7.5.3 |
| masa_cms | masa_cms | From 7.2.0 (inc) to 7.2.9 (inc) |
| masa_cms | masa_cms | From 7.3.0 (inc) to 7.3.14 (inc) |
| masa_cms | masa_cms | From 7.4.0 (inc) to 7.4.9 (inc) |
| masa_cms | masa_cms | From 7.5.0 (inc) to 7.5.2 (inc) |
| masa_cms | masa_cms | 7.2.10 |
| masa_cms | masa_cms | 7.3.15 |
| masa_cms | masa_cms | 7.4.10 |
| masa_cms | masa_cms | 7.5.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-40331 is a critical SQL Injection vulnerability in Masa CMS versions 7.2.0 through 7.5.2. The issue arises because the unauthenticated JSON API accepts an altTable parameter that is passed to the setAltTable() method without any validation or sanitization. This parameter is directly injected into a SQL FROM clause, allowing an attacker to supply arbitrary subqueries.
As a result, an unauthenticated attacker can exploit this flaw to read sensitive data from any table in the database with a single HTTP request, including administrative credentials and password reset tokens.
How can this vulnerability impact me? :
This vulnerability can have severe impacts including unauthorized access to sensitive data stored in the database, such as administrative credentials and password reset tokens.
An attacker can take over admin accounts, potentially leading to full system compromise. The vulnerability also opens the door for remote code execution, which can further escalate the attacker's control over the affected system.
The vulnerability affects all instances of Masa CMS with the JSON API enabled and has a high severity with a CVSS score of 9.8 (Critical).
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring HTTP requests to the Masa CMS JSON API for suspicious usage of the altTable parameter, especially if it contains SQL subqueries or non-alphanumeric characters.
You can use network monitoring tools or web server logs to identify such requests.
For example, using command-line tools like curl or grep to search for suspicious altTable parameters in access logs:
- grep 'altTable=' /path/to/access.log
- curl -v 'http://your-masa-cms-site/api/json?altTable=...' to test if the parameter is accepted and behaves unexpectedly.
Additionally, deploying Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the altTable parameter can help identify exploitation attempts.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include:
- Upgrade Masa CMS to a fixed version: 7.2.10, 7.3.15, 7.4.10, or 7.5.3.
- If upgrading is not immediately possible, apply manual validation to the setAltTable function in core/mura/content/feed/feedBean.cfc to restrict input to simple alphanumeric table names.
- Disable the JSON API if it is not required.
- Implement Web Application Firewall (WAF) rules to detect and block SQL injection attempts targeting the altTable parameter.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an unauthenticated attacker to read sensitive data from any table in the database, including administrative credentials and password reset tokens. Such unauthorized access to sensitive personal and administrative data can lead to violations of data protection regulations like GDPR and HIPAA, which require strict controls over access to personal and sensitive information.
Exploitation of this SQL Injection vulnerability could result in data breaches, exposing personal data and credentials, thereby compromising compliance with standards that mandate confidentiality, integrity, and security of sensitive data.