Okay, I did it

The reason was, that the changed CSFR key was only used within AJAX. A new given key has to be also in the main form. I just added one
Code:
$("input[name=cappx]").val(data.hash)
line in my success-function so that the JS-code looks like this now:
Code:
<script type="application/javascript">
var cappx = "<?= $csfrManually ?>"
function getDropdown(csfr = cappx) {
var data = {
cappx: csfr,
action: document.getElementById("massEdit").value
}
$.ajax({
url: '/collection/api/getMassEditList',
type: 'post',
dataType: 'json',
data: data,
success:function(data) {
cappx = data.hash
$("input[name=cappx]").val(data.hash);
document.getElementById("newXDropdown").innerHTML = data.target
}
});
}
</script>