CVE-2026-19677: onPhase Forms 11.0.14

Affected technology

onPhase Forms · 11.0.14
onPhase

Description’s affected range: version 11.0.14

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated remote attacker can authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary operating system commands via manipulation of registration parameters containing a valid tenant name and existing user identifier. Source advisory’s CVSS 4.0 assessment (base score 9.3/10) rates confidentiality, integrity and availability impact as high.