CVE-2026-113667 in ApostropheCMS
Summary
by MITRE • 10/20/2026
ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha, these three CAPTCHA integrations interpolate an unencoded user-supplied response token into the provider verification request. Crafted tokens can smuggle request parameters and disrupt CAPTCHA verification and CAPTCHA-gated form or login flows; automated bypass probing is possible, but a successful CAPTCHA bypass or secret disclosure is not established. This issue is fixed in Form 1.5.5, login-recaptcha 1.2.1, and login-hcaptcha 1.3.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
ApostropheCMS serves as an open-source content management system built on the Node.js platform, widely utilized for its flexibility and modular architecture. Within this ecosystem, several add-ons provide essential security features to protect against automated abuse and unauthorized access. Specifically, the Form add-on, login-recaptcha module, and login-hcaptcha module are designed to integrate third-party CAPTCHA services such as reCAPTCHA and hCaptcha into application workflows. These integrations act as a critical defense layer by ensuring that form submissions and login attempts originate from human users rather than automated bots or malicious scripts. The integrity of these security controls relies heavily on the correct handling of verification tokens exchanged between the client, the ApostropheCMS server, and the external CAPTCHA provider.
A significant technical flaw was identified in versions prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha. The core vulnerability stems from improper input handling during the verification process. When a user completes a CAPTCHA challenge, they receive a response token which is submitted back to the ApostropheCMS server. This server then forwards the token along with other parameters to the respective CAPTCHA provider for validation. In the affected versions, the application interpolates an unencoded user-supplied response token directly into this verification request without adequate sanitization or encoding. This lack of proper data handling creates a vector where crafted tokens can smuggle additional HTTP request parameters into the API call sent to the external provider.
The operational impact of this vulnerability centers on the potential disruption of CAPTCHA-gated flows rather than a direct compromise of secrets. By injecting extra parameters, an attacker may attempt to alter the behavior of the verification endpoint or confuse the logic that processes the response. This allows for automated bypass probing where attackers can systematically test various parameter injections to find configurations that might inadvertently validate requests without proper user interaction. While this mechanism does not inherently disclose sensitive information such as API keys or session tokens, it undermines the reliability of the CAPTCHA control. If an attacker successfully manipulates the verification request parameters in a way that causes the provider to return a false positive or if the application logic fails to reject malformed requests correctly, the security boundary provided by the CAPTCHA can be bypassed.
This vulnerability is best classified under CWE-20 Improper Input Validation and CWE-74 Injection, specifically involving HTTP parameter pollution techniques. From an offensive perspective, it aligns with MITRE ATT&CK technique T1190 Exploit Public-Facing Application, as the flaw resides in how a public-facing component processes untrusted input to interact with another service. The risk is particularly acute for applications relying on these modules to prevent brute-force attacks or spam submissions. Without proper validation, automated tools can potentially bypass rate limiting and authentication barriers that depend on successful CAPTCHA verification.
To mitigate this issue, organizations running ApostropheCMS must ensure they are using the patched versions of the relevant add-ons: Form 1.5.5 or later, login-recaptcha 1.2.1 or later, and login-hcaptcha 1.3.0 or later. These updates implement proper encoding and validation mechanisms to prevent user-supplied tokens from being interpreted as additional request parameters during the verification phase. Administrators should also monitor server logs for unusual patterns in CAPTCHA verification requests that might indicate probing activity. Additionally, implementing defense-in-depth strategies such as rate limiting on login endpoints and form submissions can further reduce the risk of automated abuse even if a specific vulnerability is present or undiscovered. Regularly updating dependencies to their latest stable releases remains the most effective strategy for maintaining the integrity of these security controls.