ApostropheCMS CVE-2026-113667

The target must run a vulnerable ApostropheCMS CAPTCHA integration - the Form add-on < 1.5.5, login-recaptcha < 1.2.1, or login-hcaptcha < 1.3.0 - with reCAPTCHA or hCaptcha actually configured and enabled on a form or the login page. No authentication or user interaction is required to reach the vulnerable sink: an attacker simply supplies a crafted 'response' token in the normal submission. Limiting factors: the site must have one of these specific add-ons installed and CAPTCHA enabled (not a core/default ApostropheCMS deployment), and the achievable outcome is limited to disrupting the CAPTCHA gate and automated bypass probing - the vendor confirms no secret disclosure and no proven CAPTCHA bypass.

This is a genuinely low-priority, high-noise issue despite the network-reachable vector. The input provides only a CVSS 4.0 vector (5.3, AV:N/AC:L/AT:N/PR:L/UI:N with uniformly Low VC/VI/VA); no EPSS score and no CISA KEV entry were supplied, so there is no evidence of active exploitation - only the vendor-published PoC in the GHSA advisory demonstrating the parameter-smuggling primitive. The vendor itself is explicit that the real impact is bounded: a crafted token can only inject extra key=value pairs into the outbound reCAPTCHA/hCaptcha verify call, forcing verification failures (a DoS of the CAPTCHA gate and CAPTCHA-gated login/form flows) and enabling automated bypass probing, with 'no secret exfiltration' and no established CAPTCHA bypass. Note a signal conflict: the vendor CVSS uses PR:L (implying authentication) but the affected features - the public Form add-on and the login-page reCAPTCHA/hCaptcha integrations - are reached by anonymous users, so exploitation is realistically unauthenticated (PR:N); the Low integrity/confidentiality impacts in the vendor vector are also debatable since the only concrete effect is availability of the CAPTCHA gate. The 'Authentication Bypass' tag overstates the issue: the advisory states a successful bypass is NOT established. Net: real but minor - patch on a normal cycle, not as an emergency.

An unauthenticated attacker submits a crafted CAPTCHA response token (e.g. 'attacker_token&secret=INJECTED&something=1') to an ApostropheCMS form or login endpoint running a vulnerable CAPTCHA add-on. Because the token is interpolated unencoded into the provider verification URL/body, the smuggled parameters corrupt the siteverify request and force verification to fail, disrupting the CAPTCHA-gated flow; the vendor advisory includes a working PoC of this injection, though it does not achieve a true CAPTCHA bypass or secret disclosure. Given AV:N/AC:L, this probing is trivially automatable at scale.