CVE-2026-19677

An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary operating system commands via manipulation of registration parameters containing a valid tenant name and existing user identifier.

CVSS

No CVSS.

References

Link	Resource
https://frevvo-docs.atlassian.net/wiki/spaces/frevvo110/overview?homepageId=1069252609
https://frevvo-docs.atlassian.net/wiki/spaces/frevvo110/pages/1069273270/Detailed+Release+Notes

Configurations

No configuration.

History

23 Oct 2026, 02:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-23 02:16

Updated : 2026-10-23 19:45

NVD link : CVE-2026-19677

Mitre link : CVE-2026-19677

CVE.ORG link : CVE-2026-19677

JSON object : View

Products Affected

No product.

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2026-19677", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "9c1820ae-fb77-4810-a8aa-ca46e7474d2f", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "9c1820ae-fb77-4810-a8aa-ca46e7474d2f", "affectedData": [{"vendor": "onPhase", "product": "onPhase Forms", "versions": [{"status": "affected", "version": "11.0.14"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-23T02:16:57.560", "references": [{"url": "https://frevvo-docs.atlassian.net/wiki/spaces/frevvo110/overview?homepageId=1069252609", "source": "9c1820ae-fb77-4810-a8aa-ca46e7474d2f"}, {"url": "https://frevvo-docs.atlassian.net/wiki/spaces/frevvo110/pages/1069273270/Detailed+Release+Notes", "source": "9c1820ae-fb77-4810-a8aa-ca46e7474d2f"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "9c1820ae-fb77-4810-a8aa-ca46e7474d2f", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14\u00a0allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary operating system commands via manipulation of registration parameters containing a valid tenant name and existing user identifier."}], "lastModified": "2026-10-23T19:45:03.547", "sourceIdentifier": "9c1820ae-fb77-4810-a8aa-ca46e7474d2f"}