I'm looking at building a custom web application for a client (a specialized auction site, in this case), and we're evaluating using some existing CMS as the "scaffold" for the application.
The justification is the fact that for many custom web application projects, some 70% of the code written goes in to adding CMS features, user management, and basic admin CRUD. Presumably, if we start with an existing CMS, then those to components will already be built.
We've decided to stick with PHP for distribution and deployment reasons. The top CMSes we're evaluating are Wordpress, Drupal, and Joomla. Here's our analysis so far (listed in order):
Wordpress
Pros: Dead-simple design. Extremely popular and understood. Very solid recent security history.
Cons: Perhaps a little too simple -- can it be made to work?
Drupal
Pros: Potentially more friendly to custom application development. Decent security history.
Cons: More complex and difficult to understand.
Joomla
Pros: Popular and well understood.
Cons: Some security concerns
Once of the biggest issues we're running up against, and what we hope to gain from the S.O. community is understanding how easily these can be customized to become a custom application. As an example, when the client goes into his administration area, will he get the impression that this is an, "auction site with a built-in wordpress CMS", or will it be a "wordpress site with an auction plugin"? We're hoping for the former rather than the latter. But can it be done?
Or perhaps are we looking in the wrong direction? Should we be looking instead at something like CakePHP? (Note that options like RoR and Django are off-the-table because of distribution and deployment reasons.)
Here are some related (but not identical) questions which have some useful information:
Using a CMS to Design a Web Application
CMS for custom application