[ CVE-2026-19678 · Published 23 Oct 2026 ]
Vulnerability in onPhase Forms
CVSS 8.7
EPSS <1%No fix listed yet
[ Description ]Official description
A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to access sensitive internal Apache Solr data via an attacker-controlled URL supplied to a publicly accessible form.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.