CVE-2026-115480

Что произошло

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the public POST /baser/api/bc-mail/mail_messages/add/{mailContentId}.json endpoint accepts submissions without enforcing the form's auth_captcha setting. BcMail\Controller\Api\MailMessagesController::add() and MailMessagesService::create() omit the BcCaptchaService::check() verification of captcha_id and auth_captcha performed by MailController::submit() in the web UI. An unauthenticated attacker who can reach the API can therefore automate submissions without solving the enabled image challenge. The API disables FormProtection and has no rate limit; submissions can generate administrator-inbox spam, send attacker-influenced auto-replies to third parties when an email field is present, and accumulate mail_messages database records when save_info is enabled. The API already enforces the isAccepting() check added for CVE-2026-30878; the missing CAPTCHA check is a separate control failure. This issue has been patched in versions 5.3.2 and 5.4.2.

Что делать

dpkg-query -W -f='${Package}	${Version}\n'

rpm -qa --qf '%{NAME}\t%{VERSION}-%{RELEASE}\n'

Get-HotFix | Select-Object HotFixID, InstalledOn

Продукты и затронутые версии

{
  "status": "affected",
  "version": ">= 5.0.0, < 5.3.2"
}

{
  "status": "affected",
  "version": ">= 5.4.0, < 5.4.2"
}

CVSS: оценки и векторы

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Источники и ссылки

{
  "cwes": [
    "cve",
    "nvd"
  ],
  "epss": {
    "source": "epss",
    "received_at": "2026-10-29T08:15:43.114806+00:00"
  },
  "title": {
    "source": "cve",
    "received_at": "2026-10-29T17:54:07.747373+00:00"
  },
  "scores": [
    "cve",
    "nvd"
  ],
  "status": {
    "source": "cve",
    "received_at": "2026-10-29T17:54:07.747373+00:00"
  },
  "affected": [
    "cve"
  ],
  "published": {
    "source": "cve",
    "received_at": "2026-10-29T17:54:07.747373+00:00"
  },
  "solutions": [],
  "percentile": {
    "source": "epss",
    "received_at": "2026-10-29T08:15:43.114806+00:00"
  },
  "references": [
    "cve",
    "nvd"
  ],
  "description": {
    "source": "cve",
    "received_at": "2026-10-29T17:54:07.747373+00:00"
  },
  "workarounds": [],
  "configurations": []
}

Хронология записи

1. Данные обновлены29.10.2026, 21:41
2. Появилась ссылка на PoC29.10.2026, 20:54
3. Данные обновлены29.10.2026, 11:15
4. Опубликована28.10.2026, 22:37

Личная заметка и статус

Другие CVE того же продукта