baserCMS EUVD-2026-108987

Exploitation requires a baserCMS mail form with image authentication enabled (auth_captcha = 1) - if no form has captcha enabled, there is no control to bypass and the issue is moot. The affected endpoint is the public API POST /baser/api/bc-mail/mail_messages/add/{mailContentId}.json, which is guest-reachable by design, has FormProtection explicitly disabled in beforeFilter(), and has no rate limiting. The isAccepting() check (added for CVE-2026-30878) is still enforced, so forms that are closed/not accepting submissions are rejected and are not exploitable. The database-flooding impact additionally requires save_info enabled on the form; the third-party mail-relay/auto-reply impact additionally requires the form to contain an attacker-controllable email field feeding sendFormToUser. No authentication or user interaction is needed for affected forms. The main limiting factor is therefore configuration-specific: only captcha-enabled, accepting mail forms are impacted, and the per-vector impacts depend on save_info and the presence of an email field.

This is a genuine but bounded control-failure, not a critical emergency. The CVSS 3.1 score is 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - network-reachable, low-complexity, unauthenticated, no user interaction, with impact capped at low integrity and no confidentiality or availability loss. That profile is fully consistent with the CWE-799 (Improper Control of Interaction Frequency) classification and the described abuse: captcha bypass enabling automated mail-form submissions. No EPSS score was supplied, so exploitation-probability cannot be quantified from this data. The vulnerability is not on CISA KEV and no confirmed public working exploit is referenced - the GHSA advisory contains detailed code-level reproduction steps and a local dynamic verification by the reporter, but that is distinct from a weaponized public exploit. The vuln.today Decision label is 'this_month', which aligns with a real-but-moderate priority: trivially automatable (PR:N/AC:L, FormProtection disabled, no rate limit) but low technical impact. The practical risk driver is the mail-relay/phishing vector (sendFormToUser delivers attacker-composed content to arbitrary third parties from the site's own mail server), which carries reputational and blocklisting consequences beyond the raw score. Net: patch within the normal maintenance cycle; it is not a drop-everything issue, and only forms with auth_captcha enabled are actually affected.

An unauthenticated attacker scripts repeated POST requests to /baser/api/bc-mail/mail_messages/add/{mailContentId}.json against a baserCMS mail form that has image captcha (auth_captcha) enabled, omitting the captcha_id/auth_captcha parameters that the web UI requires. Because the API never calls BcCaptchaService::check(), each request is accepted, flooding the administrator inbox, persisting junk mail_messages rows when save_info is on, and - when an email field is present - relaying attacker-authored auto-reply content to arbitrary third-party addresses via the site's mail server. No public weaponized exploit is referenced, but the advisory documents working code-level reproduction steps.