{"id":"CVE-2026-115480","kind":"vulnerability","aliases":["CVE-2026-115480"],"related":[],"title":"baserCMS: mail form API skips CAPTCHA, allowing automated spam submissions","description":"baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the public POST /baser/api/bc-mail/mail_messages/add/{mailContentId}.json endpoint accepts submissions without enforcing the form's auth_captcha setting. BcMail\\Controller\\Api\\MailMessagesController::add() and MailMessagesService::create() omit the BcCaptchaService::check() verification of captcha_id and auth_captcha performed by MailController::submit() in the web UI. An unauthenticated attacker who can reach the API can therefore automate submissions without solving the enabled image challenge. The API disables FormProtection and has no rate limit; submissions can generate administrator-inbox spam, send attacker-influenced auto-replies to third parties when an email field is present, and accumulate mail_messages database records when save_info is enabled. The API already enforces the isAccepting() check added for CVE-2026-30878; the missing CAPTCHA check is a separate control failure. This issue has been patched in versions 5.3.2 and 5.4.2.","summary":"The public mail message API in baserCMS accepts form submissions without checking the form's CAPTCHA, so a bot can submit forms without solving the challenge. An attacker can flood the administrator inbox, trigger auto-replies to third parties, and fill the database with mail message records.","severity":"medium","cvss":5.3,"epss":0.0043,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["basercms","mail-forms","package","php","self-hosted"],"not_affected_if":["captcha-disabled","no-mail-forms","patched-version"],"how_to_check":"- Check the installed baserCMS version with `composer show basercms/basercms` or the version shown in the admin footer; versions 5.0.0 to before 5.3.2 and 5.4.0 to before 5.4.2 are affected.\n- Confirm whether any mail form with auth_captcha enabled is reachable through POST `/baser/api/bc-mail/mail_messages/add/{mailContentId}.json`.","fix":"- Upgrade baserCMS to `5.3.2` on the 5.3 line or `5.4.2` on the 5.4 line.\n- Until patched, restrict or rate-limit the POST `/baser/api/bc-mail/mail_messages/add/` endpoint at the web server or WAF.","status":"open","published_at":"2026-10-23T14:17:52+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T04:18:57+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:18:57Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade baserCMS to `5.3.2` on the 5.3 line or `5.4.2` on the 5.4 line.\n- Until patched, restrict or rate-limit the POST `/baser/api/bc-mail/mail_messages/add/` endpoint at the web server or WAF.","reach":"internet","title":"baserCMS: mail form API skips CAPTCHA, allowing automated spam submissions","impact":"low","summary":"The public mail message API in baserCMS accepts form submissions without checking the form's CAPTCHA, so a bot can submit forms without solving the challenge. An attacker can flood the administrator inbox, trigger auto-replies to third parties, and fill the database with mail message records.","category":"package","nicknames":[],"who_cares":["baserCMS","php","self-hosted","mail-forms"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated bots flood admin inbox and database with spam","analyst_note":"","how_to_check":"- Check the installed baserCMS version with `composer show basercms/basercms` or the version shown in the admin footer; versions 5.0.0 to before 5.3.2 and 5.4.0 to before 5.4.2 are affected.\n- Confirm whether any mail form with auth_captcha enabled is reachable through POST `/baser/api/bc-mail/mail_messages/add/{mailContentId}.json`.","needs_analyst":false,"not_affected_if":["patched-version","no-mail-forms","captcha-disabled"],"who_is_affected":"Sites running baserCMS 5.0.0 through 5.3.x before 5.3.2, or 5.4.0 through 5.4.x before 5.4.2, that have a mail form with CAPTCHA enabled and a reachable API endpoint. Sites on patched versions or without the mail plugin's form API exposed can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000697,"input_tokens":3560,"output_tokens":683,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115480':13A,16A '-2026':12A,15A,204C '-30878':205C '/baser/api/bc-mail/mail_messages/add':92C '5.0.0':82C '5.3.2':84C,222C '5.4.0':86C '5.4.2':88C,224C 'accept':33B,96C 'accumul':184C 'add':110C,201C 'administr':57B,164C 'administrator-inbox':163C 'allow':7A 'alreadi':196C 'api':4A,30B,108C,140C,152C,195C 'attack':53B,135C,169C 'attacker-influenc':168C 'auth':103C,123C 'auto':61B,172C 'auto-repli':60B,171C 'autom':8A,143C 'basercm':1A,17B,32B,74C 'bccaptchaservic':116C 'bcmail':106C 'bot':44B 'captcha':6A,41B,104C,120C,124C,208C 'challeng':51B,150C 'check':37B,117C,200C,209C 'control':107C,213C 'creat':113C 'cve':11A,14A,203C 'databas':69B,187C 'develop':78C 'disabl':153C 'email':179C 'enabl':148C,193C 'endpoint':95C 'enforc':99C,197C 'failur':214C 'field':180C 'fill':67B 'flood':55B 'form':3A,20B,34B,39B,47B,101C 'formprotect':154C 'framework':79C 'generat':162C 'host':25B 'id':121C 'imag':149C 'inbox':58B,165C 'influenc':170C 'info':191C 'isaccept':199C 'issu':216C 'json':94C 'limit':159C 'mail':2A,19B,28B,71B,185C 'mail-form':18B 'mailcontentid':93C 'mailcontrol':127C 'mailmessagescontrol':109C 'mailmessagesservic':112C 'messag':29B,72B,186C 'miss':207C 'omit':114C 'packag':21B 'parti':65B,176C 'patch':219C 'perform':125C 'php':22B 'post':91C 'present':182C 'public':27B,90C 'rate':158C 'reach':138C 'record':73B,188C 'repli':62B,173C 'save':190C 'self':24B 'self-host':23B 'send':167C 'separ':212C 'set':105C 'skip':5A 'solv':49B,146C 'spam':9A,166C 'submiss':10A,35B,97C,144C,160C 'submit':46B,128C 'therefor':142C 'third':64B,175C 'trigger':59B 'ui':132C 'unauthent':134C 'verif':118C 'version':81C,221C 'web':131C 'websit':77C 'without':36B,48B,98C,145C","nicknames":[],"mitigations":[],"who_affected":"Sites running baserCMS 5.0.0 through 5.3.x before 5.3.2, or 5.4.0 through 5.4.x before 5.4.2, that have a mail form with CAPTCHA enabled and a reachable API endpoint. Sites on patched versions or without the mail plugin's form API exposed can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T14:17:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115480","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115480","severity":null,"published_at":"2026-10-23T14:17:52+00:00","modified_at":"2026-10-23T16:28:32+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115480","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115480","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}