---
id: "CVE-2026-19677"
kind: "vulnerability"
aliases: ["CVE-2026-19677"]
title: "onPhase Forms (frevvo): registration flaw lets attackers run OS commands"
severity: "critical"
cvss: 9.3
epss: 0.00533
exploited: false
status: "open"
category: "vendor"
products: [{"name": "onPhase Forms (frevvo)", "fixed": ["11.0.17"], "affected": "11.0.14", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["auth-bypass", "frevvo", "onphase", "onphase-forms", "other", "rce", "self-hosted", "vendor"]
not_affected_if: ["managed-hosting", "not-on-11.0.14"]
published_at: "2026-10-23T02:16:57+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19677", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:13:25+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:39:17+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-19677", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# onPhase Forms (frevvo): registration flaw lets attackers run OS commands

The public registration form in onPhase Forms (frevvo) version 11.0.14 lets an unauthenticated remote attacker log in as any tenant user. The attacker can then gain TenantAdmin and Designer rights and execute operating system commands.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:onPhase Forms (frevvo) affected 11.0.14 fixed 11.0.17

## How to check

Self-hosted: confirm your onPhase Forms/frevvo version (11.0.14 is affected; the admin UI or release notes show the build) and whether /frevvo/web/webapp/register is reachable from outside. No vendor-published check command found.

## Fix

Upgrade onPhase Forms (frevvo) to 11.0.17 or later, the fixed version listed in the sources.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-19677
- 2026-10-23T22:13:25+00:00 analyst — Fix 11.0.17 and workaround come from the vendor solution text in the CVE record as mirrored by OpenCVE; frevvo's own release notes page not read (only linked in the CVE refs). No exploitation or public PoC found (not in KEV, VulDB says no exploit). Sibling CVE-2026-19678 (SSRF to Solr) is fixed by the same 11.0.17 release. X/HN chatter not checked.
- 2026-10-23T22:39:17+00:00 analyst — Re-read the frevvo v11.0 Detailed Release Notes: the page is dated Oct 2024, stops at 11.0.14 and has no 11.0.17 entry or advisory, so it neither confirms nor contradicts the fix. It does say cloud customers are upgraded automatically on patch releases, which only suggests hosted is not exposed; no source says so for this CVE. No new sources since run 182.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-19677

## Documents

- [advisory] OpenCVE CVE-2026-19677 (CVE record incl. vendor solution) https://app.opencve.io/cve/CVE-2026-19677
- [describes] IONIX CVE-2026-19677 https://www.ionix.io/threat-center/cve-2026-19677/

## From the sources

An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary operating system commands via manipulation of registration parameters containing a valid tenant name and existing user identifier.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_