CVE-2026-115480 Details
Description
baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the public POST /baser/api/bc-mail/mail_messages/add/{mailContentId}.json endpoint accepts submissions without enforcing the form's auth_captcha setting. BcMail\Controller\Api\MailMessagesController::add() and MailMessagesService::create() omit the BcCaptchaService::check() verification of captcha_id and auth_captcha performed by MailController::submit() in the web UI. An unauthenticated attacker who can reach the API can therefore automate submissions without solving the enabled image challenge. The API disables FormProtection and has no rate limit; submissions can generate administrator-inbox spam, send attacker-influenced auto-replies to third parties when an email field is present, and accumulate mail_messages database records when save_info is enabled. The API already enforces the isAccepting() check added for CVE-2026-30878; the missing CAPTCHA check is a separate control failure. This issue has been patched in versions 5.3.2 and 5.4.2.
A vulnerability exists in baserCMS versions 5.0.0 prior to 5.3.2 and 5.4.0 prior to 5.4.2, allowing unauthenticated users to bypass CAPTCHA verification on the public mail API endpoint. The POST /baser/api/bc-mail/mail_messages/add/{mailContentId}.json endpoint does not enforce CAPTCHA checks, enabling automated submissions that can flood the database, generate spam for administrators, and misuse email functionalities. This issue arises because the API disables form protection and lacks rate limits, creating a separate control failure from a previously addressed vulnerability.
Users can update to baserCMS versions 5.3.2 or 5.4.2, both of which include the necessary CAPTCHA checks in the mail API endpoint to prevent this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 23, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/baserproject/basercms/security/advisories/GHSA-cpxq-6gjp-m59g | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/baserproject/basercms/commit/3444154ca40f308ade8991e54459248f866dcf61 | [email protected] | Source CodeVendor |
| https://github.com/baserproject/basercms/releases/tag/5.3.2 | [email protected] | Release NotesVendor |
| https://github.com/baserproject/basercms/releases/tag/5.4.2 | [email protected] | Release NotesVendor |
| https://github.com/baserproject/basercms/security/advisories/GHSA-cpxq-6gjp-m59g | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-693 | Protection Mechanism Failure | [email protected] |
| CWE-799 | Improper Control of Interaction Frequency | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| baserCMS | >= 5.0.0, <= 5.4.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 23, 2026 | New CVE Received | [email protected] |