The vulnerability arises when the unauthenticated JSON API accepts an altTable parameter that is inserted directly into a SQL FROM clause without validation or sanitization. An attacker can include an arbitrary subquery in this parameter, which is then executed by the database. This allows the unauthorized user to read sensitive data from any table, such as administrative credentials and password‑reset tokens, with a single HTTP request.

The flaw affects Masa CMS versions 7.2.0 through 7.2.9, 7.3.0 through 7.3.14, 7.4.0 through 7.4.9, and 7.5.0 through 7.5.2.

The CVSS score of 9.3 reflects a high‑severity data‑exposure risk. The vulnerability is exploitable without any authentication, via a standard web request to the JSON API. Attackers can use the unauthenticated service to inject a subquery that returns arbitrary data; the likely attack vector is a publicly reachable Masa CMS instance. The EPSS score is not available, and the simplicity of the exploit and lack of a known mitigation make the threat significant. The vulnerability is not listed in the CISA KEV catalog as of the current data.