CVE-2026-19678

A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to access sensitive internal Apache Solr data via an attacker-controlled URL supplied to a publicly accessible form.

CVSS

No CVSS.

References

Link	Resource
https://frevvo-docs.atlassian.net/wiki/spaces/frevvo110/overview?homepageId=1069252609
https://frevvo-docs.atlassian.net/wiki/spaces/frevvo110/pages/1069273270/Detailed+Release+Notes

Configurations

No configuration.

History

23 Oct 2026, 02:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-23 02:16

Updated : 2026-10-23 19:45

NVD link : CVE-2026-19678

Mitre link : CVE-2026-19678

CVE.ORG link : CVE-2026-19678

JSON object : View

Products Affected

No product.

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-19678", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "9c1820ae-fb77-4810-a8aa-ca46e7474d2f", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "9c1820ae-fb77-4810-a8aa-ca46e7474d2f", "affectedData": [{"vendor": "onPhase", "product": "onPhase Forms", "versions": [{"status": "affected", "version": "11.0.14"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-23T02:16:57.700", "references": [{"url": "https://frevvo-docs.atlassian.net/wiki/spaces/frevvo110/overview?homepageId=1069252609", "source": "9c1820ae-fb77-4810-a8aa-ca46e7474d2f"}, {"url": "https://frevvo-docs.atlassian.net/wiki/spaces/frevvo110/pages/1069273270/Detailed+Release+Notes", "source": "9c1820ae-fb77-4810-a8aa-ca46e7474d2f"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "9c1820ae-fb77-4810-a8aa-ca46e7474d2f", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to access sensitive internal Apache Solr data via an attacker-controlled URL supplied to a publicly accessible form."}], "lastModified": "2026-10-23T19:45:03.547", "sourceIdentifier": "9c1820ae-fb77-4810-a8aa-ca46e7474d2f"}

CVE-2026-19678

JSON object

Attach tags to CVE-2026-19678

Attach tags to `CVE-2026-19678`