CVE-2026-19677: Authentication Bypass Leading to Server-Side Command Execution
An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary operating system commands via manipulation of registration parameters containing a valid tenant name and existing user identifier.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.0.17 - Configuration
Keep the Document Service API disabled by setting frevvo.documentServiceApi.enabled=false.
frevvo Document Service API frevvo.documentServiceApi.enabled = false - Compensating control
If unable to upgrade immediately, block access through the reverse proxy or web application firewall to /frevvo/web/webapp/register and /frevvo/web/**/service.
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit it through the public registration form. Exploitation requires manipulating registration parameters with a valid tenant name and an existing user identifier.
What level of access can an attacker obtain?
An attacker can authenticate as an arbitrary tenant user and obtain TenantAdmin and Designer privileges. Those privileges can then be used to execute arbitrary operating system commands.
Which deployment component should be prioritized for investigation?
Prioritize publicly accessible onPhase/frevvo registration forms running version 11.0.14. Review whether the registration workflow accepts attacker-controlled tenant names and user identifiers.