CVE-2026-19678

UNKNOWN 0.0

Server-Side Request Forgery (SSRF) Leading to Internal Solr Data Disclosure

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to access sensitive internal Apache Solr data via an attacker-controlled URL supplied to a publicly accessible form.

CWE	CWE-918
Vendor	onphase
Product	onphase forms
Published	Oct 23, 2026

Stay Ahead of the Next One

Get instant alerts for onphase onphase forms

Be the first to know when new unknown vulnerabilities affecting onphase onphase forms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

onPhase / onPhase Forms

11.0.14

References

NVD ↗ CVE.org ↗ EPSS Data ↗

frevvo-docs.atlassian.net: https://frevvo-docs.atlassian.net/wiki/spaces/frevvo110/pages/1069273270/Detailed+Release+Notes frevvo-docs.atlassian.net: https://frevvo-docs.atlassian.net/wiki/spaces/frevvo110/overview?homepageId=1069252609

Credits

an1msh Crelic dwbzn