CVE-2026-115480

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the public POST /baser/api/bc-mail/mail_messages/add/{mailContentId}.json endpoint accepts submissions without enforcing the form's auth_captcha setting. BcMail\Controller\Api\MailMessagesController::add() and MailMessagesService::create() omit the BcCaptchaService::check() verification of captcha_id and auth_captcha performed by MailController::submit() in the web UI. An unauthenticated attacker who can reach the API can therefore automate submissions without solving the enabled image challenge. The API disables FormProtection and has no rate limit; submissions can generate administrator-inbox spam, send attacker-influenced auto-replies to third parties when an email field is present, and accumulate mail_messages database records when save_info is enabled. The API already enforces the isAccepting() check added for CVE-2026-30878; the missing CAPTCHA check is a separate control failure. This issue has been patched in versions 5.3.2 and 5.4.2.

• CWE-693
• CWE-799

• https://github.com/baserproject/basercms/commit/3444154ca40f308ade8991e54459248f866dcf61
• https://github.com/baserproject/basercms/releases/tag/5.3.2
• https://github.com/baserproject/basercms/releases/tag/5.4.2
• https://github.com/baserproject/basercms/security/advisories/GHSA-cpxq-6gjp-m59g
• https://github.com/baserproject/basercms/security/advisories/GHSA-cpxq-6gjp-m59g

Published

Oct 23, 2026

Last Modified

Oct 29, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-115457baserCMS is a website development framework. In versions 5.0…7.1
• CVE-2026-11546IBM WebSphere Application Server - Liberty 17.0.0.3 through …9.8
• CVE-2026-115477obsidian-tc is a governed, agent-ready Model Context Protoco…7.1
• CVE-2026-115478obsidian-tc is a governed, agent-ready Model Context Protoco…7.1
• CVE-2026-115479baserCMS is a website development framework. In versions 5.2…5.3
• CVE-2026-11548IBM WebSphere Application Server 8.5 and 9.0, and and IBM We…4.8
• CVE-2026-115481baserCMS is a website development framework. Starting in ver…8.5
• CVE-2026-115482In lsquic before 4.9.0, the HTTP/3 implementation can use an…7.5
• CVE-2026-115484A flaw was found in the iscsiuio component of open-iscsi. Th…7.6
• CVE-2026-115485A flaw was found in the iscsiuio component of open-iscsi. Th…6.3
• CVE-2026-115486A flaw was found in the iscsiuio component of open-iscsi. Th…7.1
• CVE-2026-11549IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSph…6.5