CVE-2026-76635 is a SQL injection vulnerability affecting baserCMS before version 5.3.0. The flaw exists in BcDatabaseService.php, where authenticated administrators can inject attacker-controlled table names and configuration values directly into SQL commands during various database operations. Additionally, attackers can exploit a backup restore code injection vulnerability that allows PHP code execution from schema files outside class definitions. By combining these vulnerabilities, attackers can perform error-based SQL injection to extract sensitive information such as the database version, schema details, and arbitrary data from the PostgreSQL backend.

Successful exploitation allows authenticated administrators to execute arbitrary SQL commands, potentially exposing sensitive database information including schema and data. The chained backup restore code injection flaw further enables execution of malicious PHP code, increasing the risk of data compromise and unauthorized access to backend database contents.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted users only and monitor for suspicious activity related to database operations and backup restores.