---
id: "CVE-2026-19678"
kind: "vulnerability"
aliases: ["CVE-2026-19678"]
title: "onPhase Forms: unauthenticated SSRF reads internal Apache Solr data"
severity: "high"
cvss: 8.7
epss: 0.00386
exploited: false
status: "open"
category: "other"
products: [{"name": "onPhase Forms", "fixed": ["11.0.17"], "affected": "11.0.14", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["apache-solr", "frevvo", "onphase-forms", "other", "self-hosted", "ssrf"]
not_affected_if: ["default-config", "managed-hosting"]
published_at: "2026-10-23T02:16:57+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19678", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:37:34+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-19678", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# onPhase Forms: unauthenticated SSRF reads internal Apache Solr data

Unauthenticated SSRF in the form service of onPhase Forms (formerly frevvo) 11.0.14: an attacker-supplied URL on a public form is fetched server-side and can reach internal Apache Solr data. CVSS 4.0 8.7. Vendor fix: 11.0.17, which removes the unauthenticated registration endpoint and disables the Document Service endpoint by default.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:onPhase Forms affected 11.0.14 fixed 11.0.17

## How to check

Check your on-premise onPhase Forms version (11.0.14 is affected). Check whether frevvo.documentServiceApi.enabled is true in your config, and whether /frevvo/web/webapp/register and /frevvo/web/**/service are reachable from outside.

## Fix

Upgrade to onPhase Forms 11.0.17 or later. Keep frevvo.documentServiceApi.enabled=false. If you cannot upgrade yet, block /frevvo/web/webapp/register and /frevvo/web/**/service at the reverse proxy or WAF.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-19678
- 2026-10-23T23:37:34+00:00 analyst — CNA vendor solution (via OpenCVE copy of CVE record, MON-CSIRT) says upgrade to 11.0.17; the vendor release notes page I linked only lists 11.0.14 and does not confirm the fix, so the fixed version rests on the CVE record. No exploitation or PoC found; no social discussion searched. A junk page with wrong CVE id and invented details was ignored. Sibling CVE-2026-19677 (auth bypass RCE, same version and fix) may be worth linking.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-19678

## Documents

- [advisory] OpenCVE CVE-2026-19678 (includes CNA vendor solution: upgrade to 11.0.17) https://app.opencve.io/cve/CVE-2026-19678
- [fix] onPhase Forms v11.0 Detailed Release Notes https://frevvo-docs.atlassian.net/wiki/spaces/frevvo110/pages/1069273270

## From the sources

A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to access sensitive internal Apache Solr data via an attacker-controlled URL supplied to a publicly accessible form.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_