CVE-2026-115480: baserCMS: Public Web API mail-form submission bypasses image CAPTCHA
baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the public POST /baser/api/bc-mail/mailmessages/add/{mailContentId}.json endpoint accepts submissions without enforcing the form's authcaptcha setting. BcMail\Controller\Api\MailMessagesController::add() and MailMessagesService::create() omit the BcCaptchaService::check() verification of captchaid and authcaptcha performed by MailController::submit() in the web UI. An unauthenticated attacker who can reach the API can therefore automate submissions without solving the enabled image challenge. The API disables FormProtection and has no rate limit; submissions can generate administrator-inbox spam, send attacker-influenced auto-replies to third parties when an email field is present, and accumulate mailmessages database records when saveinfo is enabled. The API already enforces the isAccepting() check added for CVE-2026-30878; the missing CAPTCHA check is a separate control failure. This issue has been patched in versions 5.3.2 and 5.4.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
baserCMSto a version that resolves this vulnerability.Fixed in 5.3.2 - Upgrade
Upgrade
baserCMSto a version that resolves this vulnerability.Fixed in 5.4.2
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running baserCMS 5.0.0 through versions before 5.3.2, or 5.4.0 through versions before 5.4.2, are affected when an attacker can reach the public mail-form API endpoint. Forms configured with auth_captcha are still bypassable through that endpoint.
What does an attacker need to exploit this issue?
No authentication, CAPTCHA solution, or user interaction is required. The attacker only needs network access to POST to /baser/api/bc-mail/mail_messages/add/{mailContentId}.json for an accepting mail form.
What is the practical impact of exploitation?
Attackers can automate form submissions, creating administrator inbox spam. Where a form includes an email field, submissions can trigger attacker-influenced auto-replies to third parties; if save_info is enabled, they can also accumulate mail_messages records in the database.
Does disabling form acceptance prevent submissions?
Yes. The API enforces the isAccepting() check, so it only accepts submissions for mail forms that are accepting entries. This check is separate from the missing CAPTCHA validation.
What version fixes the issue?
Update to baserCMS 5.3.2 or 5.4.2, depending on the release branch in use. These versions patch the missing CAPTCHA verification in the public API submission path.