baserCMS web API accepts mail forms without CAPTCHA check
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-693.
Summary
baserCMS versions from 5.0.0 before 5.3.2 and from 5.4.0 before 5.4.2 are affected. The public mail form API endpoint does not enforce the image CAPTCHA configured for a form, because it skips the CAPTCHA check that the web form performs (CWE-693). An unauthenticated remote attacker can automate submissions without solving the challenge, which can flood the administrator inbox with spam, send attacker-influenced auto-replies, and add records to the mail message database.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the public POST /baser/api/bc-mail/mail_messages/add/{mailContentId}.json endpoint accepts submissions without enforcing the form's auth_captcha setting. BcMail\Controller\Api\MailMessagesController::add() and MailMessagesService::create() omit the BcCaptchaService::check() verification of captcha_id and auth_captcha performed by MailController::submit() in the web UI. An unauthenticated attacker who can reach the API can therefore automate submissions without solving the enabled image challenge. The API disables FormProtection and has no rate limit; submissions can generate administrator-inbox spam, send attacker-influenced auto-replies to third parties when an email field is present, and accumulate mail_messages database records when save_info is enabled. The API already enforces the isAccepting() check added for CVE-2026-30878; the missing CAPTCHA check is a separate control failure. This issue has been patched in versions 5.3.2 and 5.4.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| baserproject | basercms | 5.0.0 to before 5.3.2; 5.4.0 to before 5.4.2 | 5.3.2, 5.4.2 | Patch available | CNA |
- basercms Vendorbaserproject Affected 5.0.0 to before 5.3.2; 5.4.0 to before 5.4.2 Fixed in 5.3.2, 5.4.2 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:basercms:basercms:*:*:*:*:*:*:*:* | — | — | baserproject |
- cpe:2.3:a:basercms:basercms:*:*:*:*:*:*:*:* Versions — — ·baserproject
Remediation
Upgrade baserCMS to version 5.3.2 or to version 5.4.2.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA basercms (baserproject) Fixed in 5.3.2, 5.4.2
Timeline
- 2026-10-23 Threatist record created from CVE-2026-115480
- 2026-10-29 CISA SSVC decision points changed
- 2026-10-29 Priority changed: LOW → MEDIUM
References
More baserproject vulnerabilities
- TI-2026-53549 baserCMS < 5.3.0 SQL Injection and Code Injection via BcDatabaseService.php CVSS 4.0HIGH 8.6
- TI-2026-17563 baserCMS: OS Command Injection Leading to Remote Code Execution (RCE) CVSS 3.1CRITICAL 9.1
- TI-2025-23967 baserCMS: unsafe File Upload Leading to Remote Code Execution (RCE) CVSS 3.1HIGH 8.7
- TI-2026-79890 PHP object injection in baserCMS widget-area entity CVSS 3.1HIGH 7.2
- TI-2026-79888 baserCMS: Encoded path traversal bypass in the theme file API CVSS 3.1HIGH 7.2
- TI-2026-79891 Stored cross-site scripting in baserCMS via blog comment shortcodes CVSS 3.1HIGH 7.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences