Auth bypass in Basercms
CVE-2026-30878
baserCMS is a website development framework. Prior to version 5.2.3, a public mail submission API allows unauthenticated users to submit mail form entries even when the corresponding form is not accepting submissions. This bypasses administrative controls intended to stop form intake and enables spam or abuse via the API. This issue has been patched in version 5.2.3.
EPSS: 0.004 (30.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
Affected products
- Basercms
- Baserproject Basercms — versions < 5.2.3
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
- security-advisories@github.com (x_refsource_MISC, Vendor Advisory)
- security-advisories@github.com (x_refsource_MISC, Release Notes)
Frequently asked questions
- What is CVE-2026-30878?
- CVE-2026-30878 is a medium-severity vulnerability in Basercms, classified under Improper Authorization. CVSS score: 5.3/10. Published 2026-03-31.
- How severe is CVE-2026-30878?
- Medium severity. CVSS v3 base score is 5.3 out of 10.