CVE-2026-30878CWE-285

baserCMS: Mail Form Acceptance Bypass via Public API

Medium · published March 31, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
38.2
In the wild
Unconfirmed
What it is

baserCMS is a website development framework. Prior to version 5.2.3, a public mail submission API allows unauthenticated users to submit mail form entries even when the corresponding form is not accepting submissions. This bypasses administrative controls intended to stop form intake and enables spam or abuse via the API. This issue has been patched in version 5.2.3.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00451 · 38.2th percentile
Weakness
CWE-285 · Improper Authorization
Published
2026-03-31T00:45Z
EPSS history
Timeline
  • 31 MAR 00:45Z
    baserCMS: Mail Form Acceptance Bypass via Public API
    cvelistv5