Y2Y2
Open Cyber
Public vulnerability disclosure

CVE-2026-19678

Server-Side Request Forgery (SSRF) Leading to Internal Solr Data Disclosure

publishedCWE-918

A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to access sensitive internal Apache Solr data via an attacker-controlled URL supplied to a publicly accessible form.

Investigate in Cyber JSONMarkdown
Technical severity8.7 highCVSS 4.0 · CNA: MON-CSIRT
Published2026-10-23Source updated 2026-11-02
Collected2026-11-022 attributed sources

Fixes and workarounds

Fix

* Upgrade to 11.0.17 * The unauthenticated registration endpoint has been removed. * Rules run in a sandbox that blocks access to unapproved Java classes. * The Document Service endpoint (/service) is disabled by default (frevvo.documentServiceApi.enabled=false). Re-enabling it brings back the risk of server-side request forgery and is done at the customer's own risk. * Customers who cannot upgrade immediately should block /frevvo/web/webapp/register and /frevvo/web/**/service at their reverse proxy or web application firewall.

Source: CNA: MON-CSIRT

Affected products and versions

ProductVersionsAuthority
onPhase Forms
onPhase 		11.0.14 (affected)
Other versions: unaffected 		CNA: MON-CSIRT

Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.

CVSS assessments

Version / scoreVectorAuthority
4.0 / 8.7
high		 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:NCNA: MON-CSIRT

Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

References