CVE-2026-114621

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, list and detail actions in the Admin and Api/Admin prefixes pass request query parameters, including contain, conditions, fields, finder, and order, directly to the ORM as options. A user able to log into the admin panel can embed SQL fragments in those options to execute arbitrary SQL against the application's database, including reading password hashes from the users table. Public-page and public-API fixes released in 5.3.1 and 5.4.1 did not protect these administrative paths. Setting USE_CORE_ADMIN_API to false does not prevent access through an authenticated browser session. This issue has been patched in versions 5.3.2 and 5.4.2.

• CWE-89

• https://github.com/baserproject/basercms/commit/344de2aa975eda6d85dc1fa4647ba094caf8dcb6
• https://github.com/baserproject/basercms/releases/tag/5.3.2
• https://github.com/baserproject/basercms/releases/tag/5.4.2
• https://github.com/baserproject/basercms/security/advisories/GHSA-2w6g-wp3r-26m3

Published

Oct 23, 2026

Last Modified

Oct 29, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-114616Authlib is a Python library which builds OAuth and OpenID Co…9.1
• CVE-2026-114617Authlib is a Python library which builds OAuth and OpenID Co…4.2
• CVE-2026-114618Authlib is a Python library which builds OAuth and OpenID Co…6.8
• CVE-2026-114619Authlib is a Python library which builds OAuth and OpenID Co…4.6
• CVE-2026-11462A vulnerability was found in Chengdu Everbrite Network Techn…7.3
• CVE-2026-114620Authlib is a Python library which builds OAuth and OpenID Co…5.4
• CVE-2026-114622baserCMS is a website development framework. In versions 5.2…7.2
• CVE-2026-114623baserCMS is a website development framework. In versions 5.0…6.5
• CVE-2026-114624baserCMS is a website development framework. In versions 5.0…7.2
• CVE-2026-114625VeloCloud Orchestrator (VCO) on-prem has a security issue wh…9.9
• CVE-2026-114627Web::Simple versions before 0.036 for Perl do not escape val…
• CVE-2026-114629Web::Simple versions before 0.035 for Perl allocate a buffer…7.5