CVE-2026-40331

Masa CMS is an open source content management system. In versions 7.2.0 through 7.2.9, 7.3.0 through 7.3.14, 7.4.0 through 7.4.9, and 7.5.0 through 7.5.2, the unauthenticated JSON API accepts an altTable parameter that is stored via the setAltTable() method without validation or sanitization. This value is injected directly into a SQL FROM clause within feedGateway.cfc. An unauthenticated attacker can pass an arbitrary subquery into the altTable parameter to read sensitive data from any table in the database in a single HTTP request, including administrative credentials and password reset tokens. This issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, apply validation to the setAltTable function in core/mura/content/feed/feedBean.cfc to restrict input to simple alphanumeric table names, or disable the JSON API if it is not required.

• CWE-89

• https://github.com/MasaCMS/MasaCMS/security/advisories/GHSA-jphh-r686-6w7j

Published

May 5, 2026

Last Modified

Jul 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40325Masa CMS is a content management system forked from Mura CMS…8.7
• CVE-2026-40326Masa CMS is a content management system forked from Mura CMS…7.1
• CVE-2026-40327Rejected reason: This CVE is a duplicate of another CVE.
• CVE-2026-40328Rejected reason: This CVE is a duplicate of another CVE.
• CVE-2026-40329Masa CMS is an open source content management system. In ver…9.3
• CVE-2026-40330Masa CMS is an open source content management system. In ver…9.3
• CVE-2026-40332Masa CMS is affected by an Open Redirect vulnerability due t…5.3
• CVE-2026-40333libgphoto2 is a camera access and control library. In versio…6.1
• CVE-2026-40334libgphoto2 is a camera access and control library. In versio…3.5
• CVE-2026-40335libgphoto2 is a camera access and control library. Versions …5.2
• CVE-2026-40336libgphoto2 is a camera access and control library. Versions …2.4
• CVE-2026-40337The Sentry kernel is a high security level micro-kernel impl…5.1