CVE-2026-114621 Details
Description
baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, list and detail actions in the Admin and Api/Admin prefixes pass request query parameters, including contain, conditions, fields, finder, and order, directly to the ORM as options. A user able to log into the admin panel can embed SQL fragments in those options to execute arbitrary SQL against the application's database, including reading password hashes from the users table. Public-page and public-API fixes released in 5.3.1 and 5.4.1 did not protect these administrative paths. Setting USE_CORE_ADMIN_API to false does not prevent access through an authenticated browser session. This issue has been patched in versions 5.3.2 and 5.4.2.
A SQL injection vulnerability has been identified in baserCMS versions 5.0.0 prior to 5.3.2 and 5.4.0 prior to 5.4.2. The issue arises in the admin panel and the admin API, where certain request query parameters are passed directly to the ORM. This allows authenticated users to inject SQL fragments, potentially executing arbitrary SQL commands against the application's database. For instance, it could be used to read password hashes from the users table. Although this vulnerability shares its root cause with other known issues that have been patched, the admin panel and admin API were left unaddressed.
Users can upgrade to baserCMS versions 5.3.2 or 5.4.2, both of which include the necessary security fix.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 23, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/baserproject/basercms/commit/344de2aa975eda6d85dc1fa4647ba094caf8dcb6 | [email protected] | Source CodeVendor |
| https://github.com/baserproject/basercms/releases/tag/5.3.2 | [email protected] | Release NotesVendor |
| https://github.com/baserproject/basercms/releases/tag/5.4.2 | [email protected] | Release NotesVendor |
| https://github.com/baserproject/basercms/security/advisories/GHSA-2w6g-wp3r-26m3 | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| baserCMS | >= 5.0.0, <= 5.4.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 23, 2026 | New CVE Received | [email protected] |