{"id":"EUVD-2026-105217","enisaUuid":"f922bee2-13ae-35de-ab39-67391103cc91","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha, these three CAPTCHA integrations interpolate an unencoded user-supplied response token into the provider verification request. Crafted tokens can smuggle request parameters and disrupt CAPTCHA verification and CAPTCHA-gated form or login flows; automated bypass probing is possible, but a successful CAPTCHA bypass or secret disclosure is not established. This issue is fixed in Form 1.5.5, login-recaptcha 1.2.1, and login-hcaptcha 1.3.0.","datePublished":"Oct 20, 2026, 5:33:28 PM","dateUpdated":"Oct 21, 2026, 3:53:18 PM","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-44qr-rrjg-2cqq\nhttps://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce\nhttps://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350\nhttps://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/form@1.5.5\n","aliases":"CVE-2026-113667\nGHSA-44qr-rrjg-2cqq\n","assigner":"GitHub_M","epss":0.37,"enisaIdProduct":[{"id":"0e663dbf-9d75-3150-87ff-8eeb8053672b","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 4.33.0"},{"id":"941a4b68-0a60-3a6d-ae75-b8773a150859","product":{"name":"login-recaptcha","vendor":{"name":"@apostrophecms"}},"product_version":"\u003c 1.2.1"},{"id":"bfa78ffb-66f7-3c1b-bdc4-e8d76e514a3c","product":{"name":"login-hcaptcha","vendor":{"name":"@apostrophecms"}},"product_version":"\u003c 1.3.0"},{"id":"ce0767e0-67e9-306b-928a-157e1a26af71","product":{"name":"form","vendor":{"name":"neos"}},"product_version":"\u003c 1.5.5"}],"enisaIdVendor":[{"id":"3265ca84-1fe4-35e0-9a0c-d41732bf80a3","vendor":{"name":"@apostrophecms"}},{"id":"b17d8839-6b03-3232-90f7-1ba24e1a648f","vendor":{"name":"apostrophecms"}}],"enisaIdVulnerability":[{"id":"5b240b9c-0542-3117-bf85-7ec56b7f93ec","vulnerability":{"id":"GHSA-44qr-rrjg-2cqq","description":"ApostropheCMS: CAPTCHA response token not URL-encoded","datePublished":"Oct 20, 2026, 6:05:35 PM","dateUpdated":"Oct 20, 2026, 6:05:36 PM","baseScore":0.0,"references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-44qr-rrjg-2cqq\nhttps://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce\nhttps://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350\nhttps://github.com/apostrophecms/apostrophe\nhttps://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/form@1.5.5\n","enisa_id":"EUVD-2026-105217\n","aliases":"CVE-2026-113667\nGHSA-44qr-rrjg-2cqq\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:08:27 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"c87f15ed-4d12-3214-ac0e-ec272330a99e","vulnerability":{"id":"CVE-2026-113667","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha, these three CAPTCHA integrations interpolate an unencoded user-supplied response token into the provider verification request. Crafted tokens can smuggle request parameters and disrupt CAPTCHA verification and CAPTCHA-gated form or login flows; automated bypass probing is possible, but a successful CAPTCHA bypass or secret disclosure is not established. This issue is fixed in Form 1.5.5, login-recaptcha 1.2.1, and login-hcaptcha 1.3.0.","datePublished":"Oct 20, 2026, 5:33:28 PM","dateUpdated":"Oct 21, 2026, 3:53:18 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-44qr-rrjg-2cqq\nhttps://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce\nhttps://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350\nhttps://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/form@1.5.5\n","enisa_id":"EUVD-2026-105217\n","assigner":"GitHub_M","epss":0.37,"dataProcessed":"Nov 1, 2026, 4:02:47 AM","vulnerabilityProduct":[{"id":"278d37af-0cf8-3301-be73-fa4c5bcfa00d","product":{"name":"login-recaptcha","vendor":{"name":"@apostrophecms"}},"product_version":"\u003c 1.2.1"},{"id":"3c7ff91e-cb01-33cb-afc5-7f7fec6feef0","product":{"name":"form","vendor":{"name":"neos"}},"product_version":"\u003c 1.5.5"},{"id":"6ce89a2a-d950-3c09-a56b-f38038eb86e2","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 4.33.0"},{"id":"765c3b58-81d4-3d8e-8b71-72302e5ab319","product":{"name":"login-hcaptcha","vendor":{"name":"@apostrophecms"}},"product_version":"\u003c 1.3.0"}],"vulnerabilityVendor":[{"id":"23079b12-df99-3680-9b06-79ed94ca1f24","vendor":{"name":"@apostrophecms"}},{"id":"f8216546-7a82-305a-98be-8b6b073e22a8","vendor":{"name":"apostrophecms"}}]}}],"enisaIdAdvisory":[]}