CVE-2026-40331: Masa CMS unauthenticated SQL injection via altTable parameter in JSON API
Masa CMS is an open source content management system. In versions 7.2.0 through 7.2.9, 7.3.0 through 7.3.14, 7.4.0 through 7.4.9, and 7.5.0 through 7.5.2, the unauthenticated JSON API accepts an altTable parameter that is stored via the setAltTable() method without validation or sanitization. This value is injected directly into a SQL FROM clause within feedGateway.cfc. An unauthenticated attacker can pass an arbitrary subquery into the altTable parameter to read sensitive data from any table in the database in a single HTTP request, including administrative credentials and password reset tokens.
This issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, apply validation to the setAltTable function in core/mura/content/feed/feedBean.cfc to restrict input to simple alphanumeric table names, or disable the JSON API if it is not required.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Masa CMSto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
Masa CMSto a version that resolves this vulnerability.Fixed in 7.3.15 - Upgrade
Upgrade
Masa CMSto a version that resolves this vulnerability.Fixed in 7.4.10 - Upgrade
Upgrade
Masa CMSto a version that resolves this vulnerability.Fixed in 7.5.3 - Configuration
As a workaround, apply validation in the setAltTable() function to restrict input to simple alphanumeric table names to prevent arbitrary subqueries being injected via altTable.
Masa CMS core/mura/content/feed/feedBean.cfc setAltTable input validation = Restrict altTable to simple alphanumeric table names - Configuration
If the JSON API is not required, disable it to prevent unauthenticated use of the altTable parameter.
Masa CMS JSON API JSON API availability = disable (if not required)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40331?
CVE-2026-40331 has been categorized as a medium severity vulnerability due to its potential for exploitation via unauthenticated SQL injection.
How do I fix CVE-2026-40331?
To fix CVE-2026-40331, users should upgrade Masa CMS to versions 7.2.10, 7.3.15, 7.4.10, or 7.5.3 or later.
Which versions of Masa CMS are affected by CVE-2026-40331?
CVE-2026-40331 affects Masa CMS versions 7.2.0 through 7.2.9, 7.3.0 through 7.3.14, 7.4.0 through 7.4.9, and 7.5.0 through 7.5.2.
What does CVE-2026-40331 exploit?
CVE-2026-40331 exploits an unauthenticated SQL injection vulnerability through the altTable parameter in the JSON API of Masa CMS.
Is CVE-2026-40331 a remote or local vulnerability?
CVE-2026-40331 is considered a remote vulnerability since it can be exploited without authentication.