onPhase Forms CVE-2026-19677

Exploitation requires that the public onPhase/frevvo registration form be deployed and reachable (the vulnerability is specific to this public registration endpoint in version 11.0.14). The attacker must supply registration parameters containing a valid tenant name and an existing user identifier for that tenant - so some knowledge or enumeration of a valid tenant name and an existing username is a practical prerequisite, though no authentication credentials are needed (PR:N). No user interaction and no special network position are required beyond reaching the form over the network. The principal limiting factor is exposure of the public registration form and the need for a valid tenant/user identifier; instances that do not expose this form, or are on a fixed version, are not affected.

This is a genuine high-priority issue, not a CVSS-inflation case. The vulnerability (CWE-306, Missing Authentication for a Critical Function) combines the three most dangerous CVSS 4.0 properties: network attack vector (AV:N), low complexity (AC:L), and no privileges or user interaction required (PR:N/UI:N), all yielding full high impact to confidentiality, integrity, and availability (VC:H/VI:H/VA:H) with a 9.3 Critical score. The vuln.today Decision label is act_now, and the chain (unauthenticated → arbitrary tenant user → TenantAdmin/Designer → arbitrary OS command execution) means a single reachable endpoint leads to complete host compromise, which is why the signals align toward urgent remediation. However, several corroborating signals are MISSING from the input and should not be assumed: no EPSS exploitation-probability score is provided, there is no CISA KEV listing, and no POC or exploit reference is present, so there is no public exploit identified at time of analysis. The absence of EPSS/KEV/POC data is not evidence of safety - it reflects data gaps - but it does mean active, widespread exploitation is NOT confirmed; the act_now label here is driven by the technical severity and ease of exploitation rather than by observed in-the-wild activity. One point to verify with the vendor: the two references are generic frevvo 11.0 release-notes/overview pages, not a dedicated advisory confirming the fixed version or the exact affected range, so patch details are inferred rather than confirmed.

An unauthenticated attacker locates an internet-reachable onPhase/frevvo instance (version 11.0.14) exposing the public registration form, then submits crafted registration parameters supplying a valid tenant name and an existing user identifier to authenticate as that user. Because the compromised session carries TenantAdmin and Designer privileges, the attacker uses the Designer capabilities to execute arbitrary operating-system commands on the host. No public exploit identified at time of analysis, so this reflects the described mechanism rather than a verified working PoC.