CVE-2026-115481

baserCMS is a website development framework. Starting in version 5.0.0-beta1 and prior to versions 5.3.2 and 5.4.2, `PermissionGroupsService::build()` reads a plugin's `config/permission.php` to decide what each user group may reach. When that file is absent it writes a wildcard allow rule instead: `url` `/baser/<prefix>/<plugin>/*`, `method` `*`, `auth` true, for every non-admin group. BcCustomContent has no such file in any release. After an administrator installs it, the default `operators` group can store and execute arbitrary PHP under the document root. Versions 5.3.2 and 5.4.2 patch the issue.

• CWE-434

• https://github.com/baserproject/basercms/commit/2ed19c878add5c26fc765572e0e77173c1f1fdb5
• https://github.com/baserproject/basercms/commit/b0ef31b10dc6267b48ebc9a80d34bc7c4c09c311
• https://github.com/baserproject/basercms/releases/tag/5.3.2
• https://github.com/baserproject/basercms/releases/tag/5.4.2
• https://github.com/baserproject/basercms/security/advisories/GHSA-8jrp-4h7c-m679

Published

Oct 23, 2026

Last Modified

Oct 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11546IBM WebSphere Application Server - Liberty 17.0.0.3 through …9.8
• CVE-2026-115477obsidian-tc is a governed, agent-ready Model Context Protoco…7.1
• CVE-2026-115478obsidian-tc is a governed, agent-ready Model Context Protoco…7.1
• CVE-2026-115479baserCMS is a website development framework. In versions 5.2…5.3
• CVE-2026-11548IBM WebSphere Application Server 8.5 and 9.0, and and IBM We…4.8
• CVE-2026-115480baserCMS is a website development framework. In versions 5.0…5.3
• CVE-2026-115482In lsquic before 4.9.0, the HTTP/3 implementation can use an…7.5
• CVE-2026-115484A flaw was found in the iscsiuio component of open-iscsi. Th…7.6
• CVE-2026-115485A flaw was found in the iscsiuio component of open-iscsi. Th…6.3
• CVE-2026-115486A flaw was found in the iscsiuio component of open-iscsi. Th…7.1
• CVE-2026-11549IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSph…6.5
• CVE-2026-115494A flaw in the cross-site request forgery (CSRF) prevention o…5.3