CVE-2026-115480: CWE-799: Improper Control of Interaction Frequency in baserproject basercms

The vulnerability (CVE-2026-115480) in baserCMS affects the POST /baser/api/bc-mail/mail_messages/add/{mailContentId}.json endpoint in versions >=5.0.0 <5.3.2 and >=5.4.0 <5.4.2. The API disables FormProtection and omits the captcha verification performed in the web UI, allowing unauthenticated attackers to bypass captcha controls and automate submissions. This can result in spam messages sent to administrators, attacker-influenced auto-replies to third parties if an email field is present, and database record accumulation when save_info is enabled. The API does enforce an isAccepting() check added for a different CVE but lacks the captcha check, representing an improper control of interaction frequency (CWE-799). The vulnerability has been fixed in versions 5.3.2 and 5.4.2.

An unauthenticated attacker can exploit this vulnerability to automate form submissions without solving captcha challenges, potentially causing spam in administrator inboxes, sending unwanted auto-replies to third parties, and database bloat due to excessive mail message records. There is no direct confidentiality or availability impact reported. The CVSS score is 5.3 (medium severity) with no confidentiality or availability impact but with integrity impact due to spam and unwanted messages.

This vulnerability has been patched in baserCMS versions 5.3.2 and 5.4.2. Users should upgrade to these or later versions to remediate the issue. No additional vendor advisory indicates other mitigations or that no action is required.