CVE-2026-115481High· 8.5▾ TwilightbaserCMS is a website development framework. Starting in version 5.0.0-beta1 and prior to versions 5.3.2 and 5.4.2, `PermissionGroupsService::build()` reads a plugin's `config/permission.php` to decide what each user group may reach. Whe…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 46.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
baserCMS is a website development framework. Starting in version 5.0.0-beta1 and prior to versions 5.3.2 and 5.4.2, PermissionGroupsService::build() reads a plugin's config/permission.php to decide what each user group may reach. When that file is absent it writes a wildcard allow rule instead: url /baser/<prefix>/<plugin>/*, method *, auth true, for every non-admin group. BcCustomContent has no such file in any release. After an administrator installs it, the default operators group can store and execute arbitrary PHP under the document root. Versions 5.3.2 and 5.4.2 patch the issue.
basercms >= 5.0.0-beta1, < 5.3.2basercms >= 5.4.0, < 5.4.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115479Medium· 5.3baserCMS: Mail-form auto-replies accept multiple visitor-controlled recipients
CVE-2026-115480Medium· 5.3baserCMS: Public Web API mail-form submission bypasses image CAPTCHA
CVE-2026-114621High· 8.8baserCMS: SQL injection in the admin panel and admin API
CVE-2026-114624High· 7.2baserCMS: PHP object injection via unguarded unserialize() in the widget-area entity
CVE-2026-114622High· 7.2baserCMS: Encoded path traversal bypass in the theme file API
CVE-2026-114623Medium· 6.5baserCMS: Path traversal in the BcThemeFile admin screen allows file disclosure