What is the CVSS score of CVE-2026-30878?

CVE-2026-30878 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-30878?

Yes, a patch is available for CVE-2026-30878. Update the affected software to the latest version immediately.

Basercms CVE-2026-30878

EUVD-2026-17261 MEDIUM

Improper Authorization (CWE-285)

2026-03-31 GitHub_M

GHSA-8cr7-r8qw-gp3c

Authentication Bypass Basercms

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Apr 01, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Mar 31, 2026 - 01:00 euvd

EUVD-2026-17261

Analysis Generated

Mar 31, 2026 - 01:00 vuln.today

CVE Published

Mar 31, 2026 - 00:45 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

baserCMS is a website development framework. Prior to version 5.2.3, a public mail submission API allows unauthenticated users to submit mail form entries even when the corresponding form is not accepting submissions. This bypasses administrative controls intended to stop form intake and enables spam or abuse via the API. This issue has been patched in version 5.2.3.

AnalysisAI

baserCMS versions prior to 5.2.3 allow unauthenticated remote attackers to bypass administrative form submission controls via a public mail API, enabling arbitrary form submissions even when the form is configured to reject new entries. This authentication bypass has a CVSS score of 5.3 and permits attackers to inject spam or abuse content without authorization, circumventing intended intake restrictions. Vendor-released patch available in version 5.2.3.

Technical ContextAI

baserCMS is a website development framework that provides form submission functionality through an API endpoint. The vulnerability stems from insufficient authorization checks (CWE-285: Improper Authorization) in the mail submission API handler. The API fails to properly validate whether a form is in an accepting state before processing submissions from unauthenticated users. This allows the API to process requests that bypass the administrative flag or state that normally prevents form intake through the web interface. The affected component is the public-facing mail API, which lacks the authorization controls present in other submission channels.

RemediationAI

Vendor-released patch: baserCMS 5.2.3 or later. Upgrade immediately to version 5.2.3 or the latest available release from the baserCMS project. The patch addresses the authorization bypass by implementing proper validation of form submission state in the public mail API. Detailed security advisory and patch release information are available at https://github.com/baserproject/basercms/security/advisories/GHSA-8cr7-r8qw-gp3c and https://basercms.net/security/JVN_20837860. For organizations unable to immediately patch, consider implementing network-level restrictions to the mail API endpoint or disabling the public API if form submissions are not required. However, these are temporary mitigations and not substitutes for patching.