CVE-2026-19678: Server-Side Request Forgery (SSRF) Leading to Internal Solr Data Disclosure
Published Oct 23, 2026
·Updated
A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to access sensitive internal Apache Solr data via an attacker-controlled URL supplied to a publicly accessible form.
Affected Software
1 affected component
onPhase Forms=11.0.14
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
onPhase Formsto a version that resolves this vulnerability.Fixed in 11.0.17 - Configuration
Keep the Document Service endpoint (/service) disabled; re-enabling it brings back the SSRF risk.
frevvo Document Service frevvo.documentServiceApi.enabled = false - Compensating control
For customers unable to upgrade immediately, block /frevvo/web/webapp/register and /frevvo/web/**/service at the reverse proxy or web application firewall.
Event History
Oct 23, 2026
CVE Published
via MITRE·01:23 AM
Data Sourced
via MITRE·01:23 AM
RemedyDescriptionWeakness