baserCMS public API endpoint for mail messages allows unauthenticated POST requests to add messages without honoring a CAPTCHA verification. The API omits the BcCaptchaService check that normally protects web UI submissions, representing a failure to enforce authorization controls (CWE‑693) and a bypass of CAPTCHA validation (CWE‑799). This results in spam of the administrator inbox, potential attacker‑controlled auto‑reply emails to third parties, and database growth when optional record saving is enabled.

Vendors baserproject and product baserCMS are affected. All pre‑5.3.2 releases of the 5.0.x line and the 5.4.0 to 5.4.1 releases of the 5.4.x line contain the flaw. Versions 5.3.2 and later, as well as 5.4.2 and later, contain the fix.

The CVSS score of 5.3 rates it as moderately serious. The EPSS score is not available, and it is not listed in CISA’s KEV catalog. Attackers only need to reach the server over the public network; the API is exposed without form protection or rate limiting, allowing exploitation of the authorization failure (CWE‑693) and CAPTCHA bypass (CWE‑799) with relative ease once the API is reachable.