Accessible Form Captcha CVE-2026-112067

Exploitable against the default configuration, because the audio accessibility feature that embeds the answer into the CAPTCHA image data is enabled by default; any client that can request a CAPTCHA image can read and reuse the answer. The practical requirement is simply that a TYPO3 form uses the accessible_form_captcha extension as its CAPTCHA mechanism. Limiting factors: impact is confined to defeating the CAPTCHA (no data exposure or service disruption), so real-world risk is meaningful only where this CAPTCHA is the sole anti-automation control; sites that disable the audio feature or layer additional protections (rate limiting, secondary CAPTCHA, server-side validation) materially reduce exposure.

This is a genuine but moderate-severity CAPTCHA-bypass flaw, not a high-urgency incident. The TYPO3-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation requiring no user interaction, which is consistent with the description: anyone able to request a CAPTCHA image can extract the embedded answer. However, the only impact set is VI:L (low integrity to the vulnerable system) with VC:N/VA:N - confirming the harm is limited to defeating the bot-protection control rather than exposing data or affecting availability, which is why the score lands at 6.9 (medium) despite the fully-remote vector. No EPSS score, KEV listing, SSVC decision, or POC was provided in the input, so there is no signal of active or probable exploitation; the risk is driven entirely by the control being trivially defeatable in default configurations. The practical risk is proportional to how much a given site relies on this single CAPTCHA for abuse prevention - real but bounded, and lower than the network-vector metrics alone might suggest.

An attacker (or an off-the-shelf bot framework) targets a TYPO3 site using the accessible_form_captcha extension in its default configuration. The bot requests the CAPTCHA image, parses the answer that is embedded in the image data by the default-enabled audio feature, submits it with the form, and thereby defeats the CAPTCHA to automate spam, account creation, or other form submissions. No public exploit was identified at time of analysis, but the technique requires only standard image-fetching and parsing.