High severity · published Oct 23, 2026
CVE-2026-19678
Server-Side Request Forgery (SSRF) Leading to Internal Solr Data Disclosure
New
8.7
CVSS
0.4%
EPSS
No
On KEV
Description
A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to access sensitive internal Apache Solr data via an attacker-controlled URL supplied to a publicly accessible form.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OF
onPhase Forms · onPhase
11.0.14 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-19678
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-19678
frevvo-docs.atlassian.net
https://frevvo-docs.atlassian.net/wiki/spaces/frevvo110/overview?homepageId=1069252609
frevvo-docs.atlassian.net
https://frevvo-docs.atlassian.net/wiki/spaces/frevvo110/pages/1069273270/Detailed+Release+Notes
More from onPhase Forms
9.3
CVE-2026-19677
Authentication Bypass Leading to Server-Side Command Execution