CVE-2026-115480 in BaserCMS
Summary
by MITRE • 10/23/2026
baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the public POST /baser/api/bc-mail/mail_messages/add/{mailContentId}.json endpoint accepts submissions without enforcing the form's auth_captcha setting. BcMail\Controller\Api\MailMessagesController::add() and MailMessagesService::create() omit the BcCaptchaService::check() verification of captcha_id and auth_captcha performed by MailController::submit() in the web UI. An unauthenticated attacker who can reach the API can therefore automate submissions without solving the enabled image challenge. The API disables FormProtection and has no rate limit; submissions can generate administrator-inbox spam, send attacker-influenced auto-replies to third parties when an email field is present, and accumulate mail_messages database records when save_info is enabled. The API already enforces the isAccepting() check added for CVE-2026-30878; the missing CAPTCHA check is a separate control failure. This issue has been patched in versions 5.3.2 and 5.4.2.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/23/2026
baserCMS, a widely used website development framework built on the CakePHP PHP framework, contains a critical authentication bypass vulnerability affecting specific releases prior to version 5.3.2 and 5.4.2. The flaw resides in the public API endpoint located at POST /baser/api/bc-mail/mail_messages/add/{mailContentId}.json. This endpoint is designed to accept form submissions via JSON payloads, allowing external systems or automated scripts to interact with the mail message functionality of baserCMS instances. While the standard web user interface implementation correctly enforces security controls including CAPTCHA verification and FormProtection middleware, the API controller fails to replicate these essential safeguards. Specifically, the BcMail Controller Api MailMessagesController add method and its underlying service layer do not invoke the BcCaptchaService check function that is present in the corresponding web UI submit action. This omission means that when a site administrator has enabled CAPTCHA protection for their contact forms or mail submission interfaces to prevent automated abuse, this setting is effectively ignored by any requests routed through the API endpoint rather than the traditional HTML form submission path.
The technical root cause of this vulnerability is an inconsistency in security control implementation between different entry points within the same application module. The web interface utilizes a comprehensive set of protections including CSRF tokens and CAPTCHA challenges to ensure that submissions are made by human users or at least pass basic bot detection mechanisms. In contrast, the API endpoint was developed with FormProtection disabled for performance or architectural reasons but failed to compensate for this lack of protection by implementing alternative controls such as rate limiting or strict authentication requirements. Consequently, an unauthenticated attacker who has network access to the baserCMS instance can bypass all CAPTCHA challenges regardless of whether they are enabled in the administrative settings. This represents a classic case where security is assumed based on one interface but not enforced across all interfaces that expose similar functionality. The vulnerability aligns with CWE-287 Improper Authentication as it allows an actor to authenticate or authorize actions without providing proper credentials, and also relates to CWE-915 Improper Extension of Modification of a Specific Component's Control Block since the API component fails to extend the security controls present in the main application logic.
The operational impact of this vulnerability is significant for organizations relying on baserCMS for customer communication or lead generation. Because the endpoint lacks rate limiting and CAPTCHA verification, attackers can automate high-volume submissions with minimal effort. This leads directly to denial-of-service conditions through resource exhaustion as each submission generates database records if the save_info configuration option is enabled. The accumulation of these mail_messages entries consumes disk space and memory on the backend server, potentially degrading performance for legitimate users over time. Furthermore, the lack of CAPTCHA allows spammers to flood administrator inboxes with unsolicited content, creating operational overhead as staff must manually filter or delete malicious messages. In scenarios where the form includes an email field configured to trigger auto-replies, attackers can exploit this feature to send unwanted automated responses to third-party recipients. This not only damages organizational reputation but also potentially facilitates further attacks such as phishing campaigns using trusted domain names for sending deceptive emails. The ability to automate submissions without solving image challenges makes this vulnerability particularly attractive for large-scale abuse operations compared to vulnerabilities that require manual interaction or complex exploitation steps.
Although the API endpoint does enforce an isAccepting check which was introduced in response to CVE-2026-30878, this control only verifies whether the mail form is currently active and accepting submissions from a business logic perspective. It does not address the security concern of automated abuse or bot-driven spamming. Therefore, even if the form is correctly configured to be open for public submission, it remains vulnerable to unrestricted automation due to the missing CAPTCHA validation step. This distinction highlights that functional availability controls are distinct from anti-abuse mechanisms and both must be implemented independently to ensure robust security posture. The vulnerability has been fully patched in baserCMS versions 5.3.2 and 5.4.2, where developers have aligned the API implementation with the web UI by ensuring that CAPTCHA verification is performed before processing any incoming mail message data. Organizations running affected versions should upgrade immediately to mitigate these risks. Until an update can be applied, administrators may consider implementing network-level rate limiting or IP-based restrictions on the specific API endpoint as a temporary mitigation strategy to reduce the volume of automated submissions and limit potential damage from exploitation attempts.