A public mail submission API in baserCMS allows unauthenticated users to submit entries even when the corresponding form is disabled. This bypasses administrative controls that would normally stop intake, enabling attackers to send unsolicited mail or abuse the system. The weakness is an authorization failure, classified as CWE‑285, leading to loss of control over form handling and increased attack surface for misuse of the web application.

The vulnerability affects the baserCMS framework from baserproject. Any installation running baserCMS version 5.2.2 or earlier is susceptible; baserCMS 5.2.3 and later incorporate the fix and are not impacted.

The CVSS score of 5.3 indicates moderate severity, and the lack of EPSS data suggests limited publicly known exploitation attempts. The issue is not listed in the CISA KEV catalog, implying no confirmed widespread exploits. An attacker can exploit this by sending HTTP requests to the public mail API from any IP address without authentication, making it a low‑barrier attack vector. The impact is confined to unauthorized mail submissions rather than code execution or data exfiltration.