CVE-2026-19678

CVE-2026-19678 · Server-Side Request Forgery (SSRF) Leading to Internal Solr Data Disclosure

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to access sensitive internal Apache Solr data via an attacker-controlled URL supplied to a publicly accessible form.

CVSS 8.7 · High · EPSS 0.4%

Published: 2026-10-23T01:23:08.631Z
Updated: 2026-10-23T01:23:08.631Z

Affected products and versions

onphase forms
Versions
- 11.0.14: Affected
No fix published

Original sources

https://frevvo-docs.atlassian.net/wiki/spaces/frevvo110/pages/1069273270/Detailed+Release+Notes
https://frevvo-docs.atlassian.net/wiki/spaces/frevvo110/overview?homepageId=1069252609
https://nvd.nist.gov/vuln/detail/CVE-2026-19678

Check your server →

CVE-2026-19678 · Server-Side Request Forgery (SSRF) Leading to Internal Solr Data Disclosure

Affected products and versions

onphase forms

Original sources