Medium severity · published Mar 31, 2026
CVE-2026-30878
baserCMS: Mail Form Acceptance Bypass via Public API
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
baserCMS is a website development framework. Prior to version 5.2.3, a public mail submission API allows unauthenticated users to submit mail form entries even when the corresponding form is not accepting submissions. This bypasses administrative controls intended to stop form intake and enables spam or abuse via the API. This issue has been patched in version 5.2.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BA
basercms · baserproject
< 5.2.3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-30878
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-30878
Vendor Advisory
https://basercms.net/security/JVN_20837860
Release Notes
https://github.com/baserproject/basercms/releases/tag/5.2.3
Exploit
https://github.com/baserproject/basercms/security/advisories/GHSA-8cr7-r8qw-gp3c
More from basercms
9.8
CVE-2026-30880
baserCMS: OS command injection vulnerability in installer
9.8
CVE-2026-27697
baserCMS: SQL injection vulnerability in blog post
8.8
CVE-2026-114621
baserCMS: SQL injection in the admin panel and admin API
8.5
CVE-2026-115481
baserCMS: BcCustomContent file fields can be configured to allow executable file extensions such as php, leading to arbitrary PHP file upload
7.2
CVE-2026-114624
baserCMS: PHP object injection via unguarded unserialize() in the widget-area entity