---
id: "CVE-2026-115480"
kind: "vulnerability"
aliases: ["CVE-2026-115480"]
title: "baserCMS: mail form API skips CAPTCHA, allowing automated spam submissions"
severity: "medium"
cvss: 5.3
epss: 0.0043
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["basercms", "mail-forms", "package", "php", "self-hosted"]
not_affected_if: ["captcha-disabled", "no-mail-forms", "patched-version"]
published_at: "2026-10-23T14:17:52+00:00"
first_seen_at: "2026-10-23T21:57:34+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115480", "first_seen_at": "2026-10-23T21:57:34+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115480", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# baserCMS: mail form API skips CAPTCHA, allowing automated spam submissions

The public mail message API in baserCMS accepts form submissions without checking the form's CAPTCHA, so a bot can submit forms without solving the challenge. An attacker can flood the administrator inbox, trigger auto-replies to third parties, and fill the database with mail message records.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed baserCMS version with `composer show basercms/basercms` or the version shown in the admin footer; versions 5.0.0 to before 5.3.2 and 5.4.0 to before 5.4.2 are affected.
- Confirm whether any mail form with auth_captcha enabled is reachable through POST `/baser/api/bc-mail/mail_messages/add/{mailContentId}.json`.

## Fix

- Upgrade baserCMS to `5.3.2` on the 5.3 line or `5.4.2` on the 5.4 line.
- Until patched, restrict or rate-limit the POST `/baser/api/bc-mail/mail_messages/add/` endpoint at the web server or WAF.

## Timeline

- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115480
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115480

## From the sources

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the public POST /baser/api/bc-mail/mail_messages/add/{mailContentId}.json endpoint accepts submissions without enforcing the form's auth_captcha setting. BcMail\Controller\Api\MailMessagesController::add() and MailMessagesService::create() omit the BcCaptchaService::check() verification of captcha_id and auth_captcha performed by MailController::submit() in the web UI. An unauthenticated attacker who can reach the API can therefore automate submissions without solving the enabled image challenge. The API disables FormProtection and has no rate limit; submissions can generate administrator-inbox spam, send attacker-influenced auto-replies to third parties when an email field is present, and accumulate mail_messages database records when save_info is enabled. The API already enforces the isAccepting() check added for CVE-2026-30878; the missing CAPTCHA check is a separate control failure. This issue has been patched in versions 5.3.2 and 5.4.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_