onPhase Forms: Server-side request forgery in unauthenticated form service
Summary
onPhase Forms version 11.0.14 contains a server-side request forgery (SSRF) vulnerability in its unauthenticated form service. An unauthenticated remote attacker can supply a URL to a publicly accessible form, causing the server to request internal resources and disclose sensitive data from the internal Apache Solr instance. The CVSS 4.0 score is 8.7 (High), but the impact is limited to confidentiality, with no integrity or availability impact.
Affected
- onPhase Forms 11.0.14 (per CVE record; default status unaffected)
- Other versions: not listed as affected in the sources reviewed
Fixed in
- According to the CVE record (CNA MON-CSIRT): upgrade to 11.0.17. The record also states that the unauthenticated registration endpoint was removed, rules run in a sandbox that blocks access to unapproved Java classes, and the Document Service endpoint (/service) is disabled by default.
- The vendor advisory could not be read, so the fixed version is not independently verified.
Workaround
- Block /frevvo/web/webapp/register and /frevvo/web/**/service at the reverse proxy or web application firewall (per CVE record).
- Re-enabling the Document Service endpoint (frevvo.documentServiceApi.enabled=false) brings back the SSRF risk and is done at the customer's own risk.
Exploitation
- No public proof-of-concept found (VulDB).
- Not known to be exploited in the wild; KEV: No.
- VulDB rates exploitation as easy, although no exploit is publicly known.
- EPSS: 0.00386 (low).
Our recommendation
- Inventory all onPhase Forms instances and identify version 11.0.14.
- Prioritise instances that are internet-facing: this is the main risk case.
- Upgrade to the fixed version and confirm the patch with the vendor, as the vendor advisory was not verified.
- If patching is delayed, block the registration and /service endpoints at the reverse proxy or WAF, or take the public form offline.
- Restrict outbound requests from the form server to internal networks, and allow Solr access only from required hosts.
- Also address CVE-2026-19677 (critical, missing authentication, same version) at the same time.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record (vulners) vulners.com
- CVE record (vulners cvelist) vulners.com
- onPhase Forms v11.0 Documentation frevvo-docs.atlassian.net
- onPhase Forms Detailed Release Notes v11.0 frevvo-docs.atlassian.net
- HOL Guard CVE summary hol.org
- VulDB entry vuldb.com
- Strix CVE summary www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:34.
Original description (NVD)
A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to access sensitive internal Apache Solr data via an attacker-controlled URL supplied to a publicly accessible form.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.