CVE-2026-40331

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40331", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-10T22:50:01.357Z", "datePublished": "2026-05-05T19:48:07.898Z", "dateUpdated": "2026-05-06T12:51:12.224Z"}, "containers": {"cna": {"title": "Masa CMS unauthenticated SQL injection via altTable parameter in JSON API", "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "lang": "en", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 9.3, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/MasaCMS/MasaCMS/security/advisories/GHSA-jphh-r686-6w7j", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/MasaCMS/MasaCMS/security/advisories/GHSA-jphh-r686-6w7j"}], "affected": [{"vendor": "MasaCMS", "product": "MasaCMS", "versions": [{"version": "<= 7.2.9", "status": "affected"}, {"version": ">= 7.3.0, <= 7.3.14", "status": "affected"}, {"version": ">= 7.4.0, <= 7.4.9", "status": "affected"}, {"version": ">= 7.5.0, <= 7.5.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-05T19:48:07.898Z"}, "descriptions": [{"lang": "en", "value": "Masa CMS is an open source content management system. In versions 7.2.0 through 7.2.9, 7.3.0 through 7.3.14, 7.4.0 through 7.4.9, and 7.5.0 through 7.5.2, the unauthenticated JSON API accepts an altTable parameter that is stored via the setAltTable() method without validation or sanitization. This value is injected directly into a SQL FROM clause within feedGateway.cfc. An unauthenticated attacker can pass an arbitrary subquery into the altTable parameter to read sensitive data from any table in the database in a single HTTP request, including administrative credentials and password reset tokens.\n\nThis issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, apply validation to the setAltTable function in core/mura/content/feed/feedBean.cfc to restrict input to simple alphanumeric table names, or disable the JSON API if it is not required."}], "source": {"advisory": "GHSA-jphh-r686-6w7j", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-06T12:51:04.254322Z", "id": "CVE-2026-40331", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-06T12:51:12.224Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40331", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-06T12:51:04.254322Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-06T12:51:08.274Z"}}], "cna": {"title": "Masa CMS unauthenticated SQL injection via altTable parameter in JSON API", "source": {"advisory": "GHSA-jphh-r686-6w7j", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "MasaCMS", "product": "MasaCMS", "versions": [{"status": "affected", "version": "<= 7.2.9"}, {"status": "affected", "version": ">= 7.3.0, <= 7.3.14"}, {"status": "affected", "version": ">= 7.4.0, <= 7.4.9"}, {"status": "affected", "version": ">= 7.5.0, <= 7.5.2"}]}], "references": [{"url": "https://github.com/MasaCMS/MasaCMS/security/advisories/GHSA-jphh-r686-6w7j", "name": "https://github.com/MasaCMS/MasaCMS/security/advisories/GHSA-jphh-r686-6w7j", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Masa CMS is an open source content management system. In versions 7.2.0 through 7.2.9, 7.3.0 through 7.3.14, 7.4.0 through 7.4.9, and 7.5.0 through 7.5.2, the unauthenticated JSON API accepts an altTable parameter that is stored via the setAltTable() method without validation or sanitization. This value is injected directly into a SQL FROM clause within feedGateway.cfc. An unauthenticated attacker can pass an arbitrary subquery into the altTable parameter to read sensitive data from any table in the database in a single HTTP request, including administrative credentials and password reset tokens.\n\nThis issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, apply validation to the setAltTable function in core/mura/content/feed/feedBean.cfc to restrict input to simple alphanumeric table names, or disable the JSON API if it is not required."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-05T19:48:07.898Z"}}}, "cveMetadata": {"cveId": "CVE-2026-40331", "state": "PUBLISHED", "dateUpdated": "2026-05-06T12:51:12.224Z", "dateReserved": "2026-04-10T22:50:01.357Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-05T19:48:07.898Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "MasaCMS", "vendor": "MasaCMS", "versions": [{"status": "affected", "version": "<= 7.2.9"}, {"status": "affected", "version": ">= 7.3.0, <= 7.3.14"}, {"status": "affected", "version": ">= 7.4.0, <= 7.4.9"}, {"status": "affected", "version": ">= 7.5.0, <= 7.5.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Masa CMS is an open source content management system. In versions 7.2.0 through 7.2.9, 7.3.0 through 7.3.14, 7.4.0 through 7.4.9, and 7.5.0 through 7.5.2, the unauthenticated JSON API accepts an altTable parameter that is stored via the setAltTable() method without validation or sanitization. This value is injected directly into a SQL FROM clause within feedGateway.cfc. An unauthenticated attacker can pass an arbitrary subquery into the altTable parameter to read sensitive data from any table in the database in a single HTTP request, including administrative credentials and password reset tokens.\n\nThis issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, apply validation to the setAltTable function in core/mura/content/feed/feedBean.cfc to restrict input to simple alphanumeric table names, or disable the JSON API if it is not required."}, {"lang": "es", "value": "Masa CMS es un sistema de gesti\u00f3n de contenido de c\u00f3digo abierto. En las versiones 7.2.0 a 7.2.9, 7.3.0 a 7.3.14, 7.4.0 a 7.4.9 y 7.5.0 a 7.5.2, la API JSON no autenticada acepta un par\u00e1metro altTable que se almacena a trav\u00e9s del m\u00e9todo setAltTable() sin validaci\u00f3n ni saneamiento. Este valor se inyecta directamente en una cl\u00e1usula SQL FROM dentro de feedGateway.cfc. Un atacante no autenticado puede pasar una subconsulta arbitraria al par\u00e1metro altTable para leer datos sensibles de cualquier tabla en la base de datos en una \u00fanica solicitud HTTP, incluyendo credenciales administrativas y tokens de restablecimiento de contrase\u00f1a.\n\nEste problema ha sido solucionado en las versiones 7.2.10, 7.3.15, 7.4.10 y 7.5.3. Como soluci\u00f3n alternativa, aplique validaci\u00f3n a la funci\u00f3n setAltTable en core/mura/content/feed/feedBean.cfc para restringir la entrada a nombres de tabla alfanum\u00e9ricos simples, o deshabilite la API JSON si no es necesaria."}], "id": "CVE-2026-40331", "lastModified": "2026-07-24T21:10:00.143", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40331", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-06T12:51:04.254322Z", "version": "2.0.3"}}]}, "published": "2026-05-05T20:16:39.113", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/MasaCMS/MasaCMS/security/advisories/GHSA-jphh-r686-6w7j"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.2.9]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.3.0,7.3.14]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.4.0,7.4.9]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.5.0,7.5.2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "MasaCMS", "source": "cna", "vendor": "MasaCMS"}, "product": "masacms", "vendor": "masacms"}], "created": "2026-05-05T22:00:11.996407+00:00", "updated": "2026-05-05T23:00:10.476330+00:00", "vendors": ["masacms", "masacms$PRODUCT$masacms"]}