CVE-2026-115479
Deferred Deferred - Pending Action

Email Address List Abuse in baserCMS

Publication date: 2026-10-23

Last updated on: 2026-10-23

Assigner: GitHub, Inc.

Description
baserCMS is a website development framework. In versions 5.2.5 before 5.3.2 and 5.4.0 before 5.4.2, an unauthenticated visitor can supply a comma-separated address list in a public mail form's email field and cause a single auto-reply to be addressed to multiple third parties. MailMessageMailer::sendFormToUser() passes the visitor-controlled userMail value to parseAndNormalizeMailAddresses(), which splits it with explode(',') and supplies every resulting address to setTo(). Newly created forms with an email-type field are affected when the separate, optional VALID_EMAIL server-side validation is not enabled; browser type=email validation does not prevent crafted requests. The bundled contact form enables VALID_EMAIL and is not affected. The auto-reply uses the site's sender identity and includes partially attacker-controlled content, allowing abuse of the site to deliver unsolicited mail. This issue has been patched in versions 5.3.2 and 5.4.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-23
Last Modified
2026-10-23
Generated
2026-10-24
AI Q&A
2026-10-23
EPSS Evaluated
N/A
NVD
CVE-2026-115479
EUVD
EUVD-2026-108986

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
baserproject basercms >= 5.2.5, < 5.3.2
baserproject basercms >= 5.4.0, < 5.4.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects baserCMS versions 5.2.5 before 5.3.2 and 5.4.0 before 5.4.2. An unauthenticated visitor can exploit a public mail form by entering a comma-separated list of email addresses in the email field. This causes the system to send a single auto-reply email to all listed addresses. The issue occurs because the email field input is split by commas and passed to multiple recipients without proper validation.

Detection Guidance

Check baserCMS versions 5.2.5 to 5.3.1 and 5.4.0 to 5.4.1 for the affected releases. Inspect mail form configurations for email-type fields without VALID_EMAIL validation enabled. Review mail server logs for unusual auto-reply activity to multiple recipients.

Impact Analysis

This vulnerability allows attackers to abuse your website to send unsolicited emails to multiple third parties. The auto-reply email uses your site's sender identity, which can damage your reputation and potentially get your domain blacklisted. It may also lead to increased server load due to the mass email delivery.

Compliance Impact

This vulnerability could lead to unauthorized transmission of emails, potentially violating data protection regulations like GDPR by exposing personal data to unintended recipients. It may also breach HIPAA if protected health information is mishandled through the auto-reply mechanism.

Mitigation Strategies

Upgrade baserCMS to version 5.3.2 or 5.4.2 or later. Enable VALID_EMAIL validation for all email-type fields in forms. Monitor mail server logs for suspicious auto-reply activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115479. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart