{"id":"CVE-2026-115481","kind":"vulnerability","aliases":["CVE-2026-115481"],"related":[],"title":"baserCMS: missing plugin permission file grants operators arbitrary PHP execution","description":"baserCMS is a website development framework. Starting in version 5.0.0-beta1 and prior to versions 5.3.2 and 5.4.2, `PermissionGroupsService::build()` reads a plugin's `config/permission.php` to decide what each user group may reach. When that file is absent it writes a wildcard allow rule instead: `url` `/baser/<prefix>/<plugin>/*`, `method` `*`, `auth` true, for every non-admin group. BcCustomContent has no such file in any release. After an administrator installs it, the default `operators` group can store and execute arbitrary PHP under the document root. Versions 5.3.2 and 5.4.2 patch the issue.","summary":"baserCMS builds a wildcard allow rule for any plugin that lacks a config/permission.php file, so non-admin groups gain access to every URL under that plugin. The BcCustomContent plugin ships without that file, so after an administrator installs it the default operators group can store and run arbitrary PHP on the server.","severity":"high","cvss":8.5,"epss":0.00466,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["basercms","cms","package","php","self-hosted"],"not_affected_if":["patched-version","plugin-not-installed"],"how_to_check":"- Check the installed baserCMS version with `bin/cake baser version` or the admin footer; versions below `5.3.2` on the 5.3 line or below `5.4.2` on the 5.4 line are exposed.\n- Check whether the BcCustomContent plugin is installed by looking for `plugins/BcCustomContent` under the baserCMS root.\n- Review the `operators` group permissions in the admin for any wildcard rule under `/baser/<prefix>/bc-custom-content/*`.","fix":"- Upgrade baserCMS to `5.3.2` (5.3 line) or `5.4.2` (5.4 line) or later.\n- Until upgraded, remove the BcCustomContent plugin or restrict the `operators` group's access to its URLs.","status":"open","published_at":"2026-10-23T14:17:52+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T03:00:16+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:00:16Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade baserCMS to `5.3.2` (5.3 line) or `5.4.2` (5.4 line) or later.\n- Until upgraded, remove the BcCustomContent plugin or restrict the `operators` group's access to its URLs.","reach":"internet","title":"baserCMS: missing plugin permission file grants operators arbitrary PHP execution","impact":"high","summary":"baserCMS builds a wildcard allow rule for any plugin that lacks a config/permission.php file, so non-admin groups gain access to every URL under that plugin. The BcCustomContent plugin ships without that file, so after an administrator installs it the default operators group can store and run arbitrary PHP on the server.","category":"package","nicknames":[],"who_cares":["basercms","php","self-hosted","cms"],"confidence":0.7,"needs_auth":"yes","worst_case":"Code runs on the server with the web server's privileges.","analyst_note":"Confirm the exact affected version range and the BcCustomContent plugin's exact install path and route prefix against the NVD entry and the baserCMS release notes for 5.3.2 and 5.4.2.","how_to_check":"- Check the installed baserCMS version with `bin/cake baser version` or the admin footer; versions below `5.3.2` on the 5.3 line or below `5.4.2` on the 5.4 line are exposed.\n- Check whether the BcCustomContent plugin is installed by looking for `plugins/BcCustomContent` under the baserCMS root.\n- Review the `operators` group permissions in the admin for any wildcard rule under `/baser/<prefix>/bc-custom-content/*`.","needs_analyst":true,"not_affected_if":["plugin-not-installed","patched-version"],"who_is_affected":"Sites running baserCMS 5.0.0-beta1 up to but not including 5.3.2 or 5.4.2 that have installed the BcCustomContent plugin. The plugin has to be installed by an administrator before the flaw applies, and the exposure comes from the default operators group being able to reach its wildcard rule. Sites without that plugin installed are not affected by this specific path.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000728,"input_tokens":3417,"output_tokens":772,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115481':13A,16A '-2026':12A,15A '/baser':123C '5.0.0':86C '5.3.2':92C,161C '5.4.2':94C,163C 'absent':114C 'access':44B 'admin':41B,131C 'administr':61B,143C 'allow':28B,119C 'arbitrari':8A,72B,154C 'auth':125C 'basercm':1A,17B,24B,77C 'bccustomcont':52B,133C 'beta1':87C 'build':25B,96C 'cms':18B 'config/permission.php':36B,101C 'cve':11A,14A 'decid':103C 'default':65B,147C 'develop':81C 'document':158C 'everi':46B,128C 'execut':10A,153C 'file':5A,37B,57B,112C,137C 'framework':82C 'gain':43B 'grant':6A 'group':42B,67B,107C,132C,149C 'host':23B 'instal':62B,144C 'instead':121C 'issu':166C 'lack':34B 'may':108C 'method':124C 'miss':2A 'non':40B,130C 'non-admin':39B,129C 'oper':7A,66B,148C 'packag':19B 'patch':164C 'permiss':4A 'permissiongroupsservic':95C 'php':9A,20B,73B,155C 'plugin':3A,32B,50B,53B,99C 'prior':89C 'reach':109C 'read':97C 'releas':140C 'root':159C 'rule':29B,120C 'run':71B 'self':22B 'self-host':21B 'server':76B 'ship':54B 'start':83C 'store':69B,151C 'true':126C 'url':47B,122C 'user':106C 'version':85C,91C,160C 'websit':80C 'wildcard':27B,118C 'without':55B 'write':116C","nicknames":[],"mitigations":[],"who_affected":"Sites running baserCMS 5.0.0-beta1 up to but not including 5.3.2 or 5.4.2 that have installed the BcCustomContent plugin. The plugin has to be installed by an administrator before the flaw applies, and the exposure comes from the default operators group being able to reach its wildcard rule. Sites without that plugin installed are not affected by this specific path.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T14:17:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115481","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115481","severity":null,"published_at":"2026-10-23T14:17:52+00:00","modified_at":"2026-10-23T16:28:32+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115481","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115481","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}