{"id":"CVE-2026-118582","kind":"vulnerability","aliases":["CVE-2026-118582"],"related":[],"title":"Drupal CAPTCHA module: alternate path lets bots skip the CAPTCHA check","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass. This issue affects CAPTCHA versions: from 0.0.0 to 1.18.0, from 2.0.0 to 2.0.11.","summary":"The Drupal CAPTCHA module has an authentication bypass through an alternate path or channel, letting a request skip the CAPTCHA protection. The sources say an attacker can bypass functionality, but they do not state the exact data or access gained.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["captcha","drupal","package","php"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed CAPTCHA module version with `drush pm:list --filter=captcha` or the Drupal admin Extend page.\n- Treat versions `1.18.0` and earlier, and `2.0.0` through `2.0.11`, as affected.","fix":"- Move to a CAPTCHA release after `2.0.11` for the 2.x line, or after `1.18.0` for the 1.x line; the sources do not name the exact fixed version.","status":"open","published_at":"2026-10-30T04:18:23+00:00","first_seen_at":"2026-10-30T04:28:39+00:00","triaged_at":"2026-10-30T04:29:00+00:00","updated_at":"2026-10-30T04:29:00+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-30T04:29:00Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a CAPTCHA release after `2.0.11` for the 2.x line, or after `1.18.0` for the 1.x line; the sources do not name the exact fixed version.","reach":"internet","title":"Drupal CAPTCHA module: alternate path lets bots skip the CAPTCHA check","impact":"low","summary":"The Drupal CAPTCHA module has an authentication bypass through an alternate path or channel, letting a request skip the CAPTCHA protection. The sources say an attacker can bypass functionality, but they do not state the exact data or access gained.","audience":"developers","category":"package","nicknames":[],"who_cares":["drupal","captcha","php"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"automated requests skip CAPTCHA checks on protected forms","analyst_note":"Confirm the fixed versions and the exact bypassed forms on the Drupal security advisory for CAPTCHA; the NVD entry gives only the affected ranges.","how_to_check":"- Check the installed CAPTCHA module version with `drush pm:list --filter=captcha` or the Drupal admin Extend page.\n- Treat versions `1.18.0` and earlier, and `2.0.0` through `2.0.11`, as affected.","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites that run the CAPTCHA module on forms such as login or registration are exposed, since the bypass lets requests skip the CAPTCHA check. Sites without the module, or with it disabled, are not affected. The sources do not say which forms or configurations are most at risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000722,"input_tokens":4124,"output_tokens":619,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118582':14A,17A '-2026':13A,16A '0.0.0':83C '1.18.0':85C '2.0.0':87C '2.0.11':89C 'access':60B 'affect':79C 'allow':74C 'altern':4A,32B,66C 'attack':47B 'authent':28B,62C 'bot':7A 'bypass':29B,49B,63C,76C 'captcha':2A,10A,18B,24B,41B,73C,80C 'channel':35B,69C 'check':11A 'cve':12A,15A 'data':58B 'drupal':1A,19B,23B,72C 'exact':57B 'function':50B,75C 'gain':61B 'issu':78C 'let':6A,36B 'modul':3A,25B 'packag':20B 'path':5A,33B,67C 'php':21B 'protect':42B 'request':38B 'say':45B 'skip':8A,39B 'sourc':44B 'state':55B 'use':64C 'version':81C 'vulner':70C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that run the CAPTCHA module on forms such as login or registration are exposed, since the bypass lets requests skip the CAPTCHA check. Sites without the module, or with it disabled, are not affected. The sources do not say which forms or configurations are most at risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T04:18:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118582","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118582","severity":null,"published_at":"2026-10-30T04:18:23+00:00","modified_at":"2026-10-30T04:18:23+00:00","first_seen_at":"2026-10-30T04:28:39+00:00","fetched_at":"2026-10-30T04:28:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}