CVE-2026-113667

Name of the Vulnerable Software and Affected Versions ApostropheCMS Form versions prior to 1.5.5 ApostropheCMS login-recaptcha versions prior to 1.2.1 ApostropheCMS login-hcaptcha versions prior to 1.3.0

Description CAPTCHA integrations in the Form, login-recaptcha, and login-hcaptcha modules interpolate unencoded user-supplied response tokens into provider verification requests. This allows an attacker to use crafted tokens to smuggle request parameters into the server-side verification URL or body. This behavior can disrupt CAPTCHA verification and interfere with CAPTCHA-gated form or login flows, enabling automated bypass probing. The issue occurs because the recaptcha and token variables are inserted directly into the request without proper encoding.

Recommendations Update ApostropheCMS Form to version 1.5.5. Update ApostropheCMS login-recaptcha to version 1.2.1. Update ApostropheCMS login-hcaptcha to version 1.3.0.