EUVD-2026-89673Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed baserCMS instance
-
ExploitSend unauthenticated request to unprotected function
-
ExecutionServer skips authentication check
-
ImpactRetrieve leaked sensitive information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only network reachability to a baserCMS instance exposing the affected function that lacks an authentication check (CWE-306); per CVSS PR:N/UI:N no credentials or user interaction are needed against default deployments. The limiting factor is impact scope, not access: only partial confidentiality is affected (C:L, no integrity or availability), so the attacker obtains some sensitive information but cannot modify data or disrupt service. The exact endpoint and affected version are not specified in the provided description and should be confirmed via JVN14353754. |
| Impact | This is a moderate-severity, low-real-risk issue by current signals. The CVSS 3.0 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3) describes a remote, unauthenticated, low-complexity flaw with no user interaction, but the impact is confined to partial confidentiality (C:L) with no integrity or availability effect - consistent with CWE-306 (missing authentication for a critical function) leaking some sensitive information rather than enabling full compromise. There is no EPSS score, no CISA KEV listing, and no public exploit code in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. The description text is truncated/garbled ('If a remote unauthenticated attacker there is a possibility that sensitive information could be obtained'), so the exact endpoint and the specific data exposed are not confirmed from the input - the JVN/vendor advisories should be consulted for the precise affected function. Overall this reads as a genuine but low-priority information-disclosure bug: easy to reach but limited in payoff. |
| Exploit ScenarioDerived | A remote attacker sends an unauthenticated HTTP request directly to a baserCMS endpoint that fails to enforce authentication, and the server returns sensitive information without checking credentials. No user interaction, valid account, or special client is needed. No public proof-of-concept was provided in the source data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Missing authentication checks in baserCMS (CWE-306) let remote, unauthenticated attackers reach a critical function and read sensitive information without supplying any credentials. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (score 5.3), meaning the constraint is impact scope rather than access: only partial confidentiality is lost, and there is no path to modify data or disrupt the site. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV, so this is a moderate-severity, low-real-risk issue by current signals; the specific affected endpoint and version should be confirmed against JVN14353754.
RemediationAI
No vendor-released patch version is identified in the available data at time of analysis, so the first action is to review the JVN advisory (https://jvn.jp/en/jp/JVN14353754) and the baserCMS security page (https://basercms.net/security/JVN_14353754) to confirm the affected version range and any fixed release, then upgrade to that release as soon as it is published. Until a fixed version is available and deployed, compensate for the missing authentication check at the perimeter: restrict access to the CMS itself - including the specific unauthenticated function once identified - to trusted IP ranges via firewall or reverse-proxy allow-lists, accepting that this breaks access for legitimate remote editors and mobile users; or place the instance behind an authenticating reverse proxy or SSO gateway so anonymous requests never reach the affected endpoint, accepting the added session-handling complexity and possible breakage of public-facing features. If the affected function can be identified and is not required, disable or unpublish it, and add WAF rules that reject unauthenticated requests to that path - while noting that signature-based blocking is bypassable via encoding tricks and should be treated as defense in depth rather than a fix. Given the C:L rating and no confirmed exploitation, aggressive service shutdown is not warranted, but log and monitor anonymous requests to CMS endpoints for anomalous data retrieval while remediation is pending.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-306 (Missing Authentication for Critical Function) in baserCMS, a PHP-based open-source content management system widely used for Japanese-language sites. Rather than a memory-safety or injection defect, the flaw is an access-control omission: a function that the application treats as sensitive is reachable without any authentication or authorization step, so the server processes the request and returns data to an anonymous caller. The CPE string cpe:2.3:a:basercms_user_community:basercms:*:*:*:*:*:*:*:* identifies the affected codebase as the baserCMS project distribution, and the wildcard version field means the CPE provides no version scoping - the precise vulnerable release range and the exact unauthenticated endpoint are not enumerated in the provided data and must be taken from the JVN and baserCMS vendor advisories. Because the CVSS vector carries PR:N and UI:N, exploitation requires only network reachability to a default deployment exposing the affected function; the limiting factor is the C:L rating, which caps the outcome at disclosure of some sensitive information with no integrity or availability impact.
Know when Basercms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Remote unauthenticated access to a function missing authentication (AV:N/AC:L/PR:N/UI:N); impact limited to partial information disclosure, hence C:L with I:N/A:N.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
Lifecycle Timeline
2DescriptionCVE.org
Missing authentication for critical function vulnerability exists in baserCMS . If a remote unauthenticated attacker there is a possibility that sensitive information could be obtained.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
In baserCMS before 4.1.4, lib\Baser\Model\ThemeConfig.php allows remote attackers to execute arbitrary PHP code via the
SQL injection vulnerability in the baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to execute arb
baserCMS is a website development framework. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploita
baserCMS is a website development framework. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploita
baserCMS is a Content Management system. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
baserCMS is a Content Management system. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
OS command injection in baserCMS installer prior to version 5.2.3 allows remote attackers to execute arbitrary system co
OS command injection in baserCMS update functionality allows authenticated administrators to execute arbitrary commands
OS command injection in baserCMS core update functionality allows authenticated administrators to execute arbitrary syst
baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows an attacker to execute arbitrary PHP code on the server via unspec
Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote attacke
Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote attacke
GitHub PoC
Exploit-DB