CVE-2026-113667Medium· 5.3▾ SunlitApostropheCMS: CAPTCHA response token not URL-encoded
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Summary Form and login CAPTCHA verification interpolate the user-supplied widget token unencoded into the server-side verification URL/body, allowing a crafted token to inject query parameters into the reCAPTCHA/hCaptcha verify request.
Details
packages/form/lib/recaptcha.js:39 — recaptchaUri = 'https://www.google.com/recaptcha/api/siteverify?secret=${recaptchaSecret}&response=${input.recaptcha}'packages/login-recaptcha/index.js:44 — same pattern for loginpackages/login-hcaptcha/index.js:47 — body: 'response=${token}&secret=${secret}'PoC
input.recaptcha = 'attacker_token&secret=INJECTED_SECRET&something=1'
→ resulting verify URL:
https://www.google.com/recaptcha/api/siteverify?secret=<real>&response=attacker_token&secret=INJECTED_SECRET&something=1
# (replicated exactly from recaptcha.js:39)
Impact
Low: a crafted token smuggles extra key=value pairs (secret, extra response) into the outbound verify call, forcing verification failures (DoS of the captcha gate and of captcha-gated login/form flows) and enabling automated bypass probing; no secret exfiltration.
Remediation — Build the verify request with URL + searchParams (or encodeURIComponent on both secret and response), and validate the token against ^[A-Za-z0-9._-]{1,2048}$ before use.
@apostrophecms/form < 1.5.5@apostrophecms/login-recaptcha < 1.2.1@apostrophecms/login-hcaptcha < 1.3.0Upgrade to a patched release:
@apostrophecms/form 1.5.5@apostrophecms/login-recaptcha 1.2.1@apostrophecms/login-hcaptcha 1.3.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-113656Medium· 5.3ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS
CVE-2026-113664Medium· 5.3ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test
CVE-2026-113662Medium· 5.4ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document
CVE-2026-113668Medium· 5.3ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)
CVE-2026-113666High· 7.1ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service
CVE-2026-113671Medium· 4.3ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF