CVE-2026-115480— baserCMS: Public Web API mail-form submission bypasses image CAPTCHA
Quick assessment
Affected
baserproject basercms
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
baserCMS 是一个网站开发框架。在 5.0.0 至 5.3.2 之前的版本，以及 5.4.0 至 5.4.2 之前的版本中，公开 API 端点 在接收提交时未强制执行表单的 设置。具体而言， 和 方法省略了 Web 界面中由 执行的 对 和 的验证。因此，任何能够访问该 API 的未认证攻击者均可在不解决已启用的图像验证码挑战的情况下，自动化提交表单。该 API 禁用了表单保护（FormProtection）且未设置速率限制，导致攻击者可生成管理员邮箱垃圾邮件；若表单中包含邮箱字段，还可向第三方发送由攻击者控
Possible ATT&CK Techniques 2 AI
T1566.002 · Spearphishing Link T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| baserproject | basercms | >= 5.0.0, < 5.3.2 |
affected |
>= 5.4.0, < 5.4.2 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-115480
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
baserCMS: Public Web API mail-form submission bypasses image CAPTCHA
Source: CVE Program / CVE List V5
Vulnerability Description
baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the public POST /baser/api/bc-mail/mail_messages/add/{mailContentId}.json endpoint accepts submissions without enforcing the form's auth_captcha setting. BcMail\Controller\Api\MailMessagesController::add() and MailMessagesService::create() omit the BcCaptchaService::check() verification of captcha_id and auth_captcha performed by MailController::submit() in the web UI. An unauthenticated attacker who can reach the API can therefore automate submissions without solving the enabled image challenge. The API disables FormProtection and has no rate limit; submissions can generate administrator-inbox spam, send attacker-influenced auto-replies to third parties when an email field is present, and accumulate mail_messages database records when save_info is enabled. The API already enforces the isAccepting() check added for CVE-2026-30878; the missing CAPTCHA check is a separate control failure. This issue has been patched in versions 5.3.2 and 5.4.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
交互频率的控制不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| baserproject | basercms | >= 5.0.0, < 5.3.2 | - |
|
II. Public POCs for CVE-2026-115480
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-115480
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-115480 (1)
Vendor Advisories for CVE-2026-115480 (1)
Vendor Pages for CVE-2026-115480 (1)
-
🔗 Release baserCMS 5.3.2 リリース · baserproject/basercms · GitHub x_refsource_MISC
Same Patch Batch · baserproject · 2026-10-23 · 8 CVEs total
| CVE-2026-114621 | 8.8 HIGH | baserCMS: SQL injection in the admin panel and admin API |
| CVE-2026-115481 | 8.5 HIGH | baserCMS: BcCustomContent file fields can be configured to allow executable file extension |
| CVE-2026-114622 | 7.2 HIGH | baserCMS: Encoded path traversal bypass in the theme file API |
| CVE-2026-114624 | 7.2 HIGH | baserCMS: PHP object injection via unguarded unserialize() in the widget-area entity |
| CVE-2026-115457 | 7.1 HIGH | baserCMS: Unauthenticated Stored XSS via Shortcode Expansion in Blog Comments |
| CVE-2026-114623 | 6.5 MEDIUM | baserCMS: Path traversal in the BcThemeFile admin screen allows file disclosure |
| CVE-2026-115479 | 5.3 MEDIUM | baserCMS: Mail-form auto-replies accept multiple visitor-controlled recipients |
IV. Related Vulnerabilities
Same product: basercms
-
CVE-2026-115457
baserCMS: Unauthenticated Stored XSS via Shortcode Expansion -
CVE-2026-114624
baserCMS: PHP object injection via unguarded unserialize() i -
CVE-2026-114623
baserCMS: Path traversal in the BcThemeFile admin screen all -
CVE-2026-114622
baserCMS: Encoded path traversal bypass in the theme file AP -
CVE-2026-114621
baserCMS: SQL injection in the admin panel and admin API
Same vendor: baserproject
-
CVE-2026-115457
baserCMS: Unauthenticated Stored XSS via Shortcode Expansion -
CVE-2026-114624
baserCMS: PHP object injection via unguarded unserialize() i -
CVE-2026-114623
baserCMS: Path traversal in the BcThemeFile admin screen all -
CVE-2026-114622
baserCMS: Encoded path traversal bypass in the theme file AP -
CVE-2026-114621
baserCMS: SQL injection in the admin panel and admin API
Same weakness: CWE-799
-
CVE-2026-115359
OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Role-Based Rate -
CVE-2026-96364
Webform - Moderately critical - Access bypass - SA-CONTRIB-2 -
CVE-2026-107830
Jivejdon through commit ee67a65e Missing Rate Limiting via / -
CVE-2026-82924
PII Enumeration via Missing Rate Limiting in Pusula Communic -
CVE-2026-97300
WordPress WP Event Solution plugin <= 4.1.25 - Broken Access
V. Comments for CVE-2026-115480
No comments yet