{"id":"CVE-2026-19678","kind":"vulnerability","aliases":["CVE-2026-19678"],"related":[],"title":"onPhase Forms: unauthenticated SSRF reads internal Apache Solr data","description":"A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to access sensitive internal Apache Solr data via an attacker-controlled URL supplied to a publicly accessible form.","summary":"Unauthenticated SSRF in the form service of onPhase Forms (formerly frevvo) 11.0.14: an attacker-supplied URL on a public form is fetched server-side and can reach internal Apache Solr data. CVSS 4.0 8.7. Vendor fix: 11.0.17, which removes the unauthenticated registration endpoint and disables the Document Service endpoint by default.","severity":"high","cvss":8.7,"epss":0.00386,"exploited":false,"exploited_at":null,"products":[{"name":"onPhase Forms","fixed":["11.0.17"],"affected":"11.0.14","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apache-solr","frevvo","onphase-forms","other","self-hosted","ssrf"],"not_affected_if":["default-config","managed-hosting"],"how_to_check":"Check your on-premise onPhase Forms version (11.0.14 is affected). Check whether frevvo.documentServiceApi.enabled is true in your config, and whether /frevvo/web/webapp/register and /frevvo/web/**/service are reachable from outside.","fix":"Upgrade to onPhase Forms 11.0.17 or later. Keep frevvo.documentServiceApi.enabled=false. If you cannot upgrade yet, block /frevvo/web/webapp/register and /frevvo/web/**/service at the reverse proxy or WAF.","status":"open","published_at":"2026-10-23T02:16:57+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:35:07+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-23T22:35:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"onPhase Forms: unauthenticated SSRF reads internal Apache Solr data","impact":"medium","summary":"An unauthenticated remote attacker can submit an attacker-controlled URL to a public form in onPhase Forms 11.0.14, making the server fetch it. This reaches internal Apache Solr data that the attacker should not be able to see.","category":"other","who_cares":["onphase-forms","apache-solr","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Internal Apache Solr data is readable by an unauthenticated internet attacker","analyst_note":"Confirm the fixed onPhase Forms version and whether the public form endpoint is exposed by default; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-19678.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000477,"input_tokens":2916,"output_tokens":371,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed onPhase Forms version and whether the public form endpoint is exposed by default; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-19678.","search":"'-19678':12A,15A '-2026':11A,14A '11.0.14':41B,98C '11.0.17':68B '4.0':64B '8.7':65B 'access':108C,124C 'allow':102C 'apach':7A,19B,60B,111C 'apache-solr':18B 'attack':44B,106C,117C 'attacker-control':116C 'attacker-suppli':43B 'control':118C 'cve':10A,13A 'cvss':63B 'data':9A,62B,113C 'default':82B 'disabl':76B 'document':78B 'endpoint':74B,80B 'fetch':52B 'fix':67B 'forgeri':88C 'form':2A,24B,34B,38B,50B,94C,101C,125C 'former':39B 'forms':17A 'frevvo':21B,40B 'host':28B 'intern':6A,59B,110C 'onphas':1A,23B,37B,100C 'onphase':16A 'onphase-form':22B 'public':49B,123C 'reach':58B 'read':5A 'registr':73B 'remot':105C 'remov':70B 'request':87C 'self':27B 'self-host':26B 'sensit':109C 'server':54B,85C 'server-sid':53B,84C 'servic':35B,79B,95C 'side':55B,86C 'solr':8A,20B,61B,112C 'ssrf':4A,29B,31B,89C 'suppli':45B,120C 'unauthent':3A,30B,72B,93C,104C 'url':46B,119C 'vendor':66B 'version':97C 'via':114C 'vulner':90C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T02:16:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"9c1820ae-fb77-4810-a8aa-ca46e7474d2f","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-19678","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19678","severity":null,"published_at":"2026-10-23T02:16:57+00:00","modified_at":"2026-10-23T19:45:03+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-19678:483","url":null,"severity":null,"published_at":"2026-10-23T23:37:34+00:00","modified_at":"2026-10-23T23:37:34+00:00","first_seen_at":"2026-10-23T23:37:34+00:00","fetched_at":"2026-10-23T23:37:34+00:00","note":"CNA vendor solution (via OpenCVE copy of CVE record, MON-CSIRT) says upgrade to 11.0.17; the vendor release notes page I linked only lists 11.0.14 and does not confirm the fix, so the fixed version rests on the CVE record. No exploitation or PoC found; no social discussion searched. A junk page with wrong CVE id and invented details was ignored. Sibling CVE-2026-19677 (auth bypass RCE, same version and fix) may be worth linking."},{"source":"epss","external_id":"CVE-2026-19678","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-19678","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":2077,"url":"https://app.opencve.io/cve/CVE-2026-19678","title":"OpenCVE CVE-2026-19678 (includes CNA vendor solution: upgrade to 11.0.17)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2078,"url":"https://frevvo-docs.atlassian.net/wiki/spaces/frevvo110/pages/1069273270","title":"onPhase Forms v11.0 Detailed Release Notes","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}