Live › vulnerability › CVE-2026-19678
Go to dashboardUnauthenticated SSRF in the form service of onPhase Forms (formerly frevvo) 11.0.14: an attacker-supplied URL on a public form is fetched server-side and can reach internal Apache Solr data. CVSS 4.0 8.7. Vendor fix: 11.0.17, which removes the unauthenticated registration endpoint and disables the Document Service endpoint by default.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| onPhase Forms | vendor | 11.0.14 | 11.0.17 |
Check your on-premise onPhase Forms version (11.0.14 is affected). Check whether frevvo.documentServiceApi.enabled is true in your config, and whether /frevvo/web/webapp/register and /frevvo/web/**/service are reachable from outside.
Upgrade to onPhase Forms 11.0.17 or later. Keep frevvo.documentServiceApi.enabled=false. If you cannot upgrade yet, block /frevvo/web/webapp/register and /frevvo/web/**/service at the reverse proxy or WAF.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to access sensitive internal Apache Solr data via an attacker-controlled URL supplied to a publicly accessible form.
This page as .md · .json · in your agent: get_signal("CVE-2026-19678")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.