CAPTCHA Vulnerability in TYPO3 Extension by TYPO3
CVE-2026-112067

6.9MEDIUM

Key Information:

Vendor

Typo3

Status
Extension "accessible Form Captcha"
Vendor
CVE Published:
20 October 2026

What is CVE-2026-112067?

The TYPO3 CAPTCHA Extension contains a vulnerability that compromises the integrity of CAPTCHA challenges. The extension inadvertently embeds the answers to CAPTCHA challenges within the image data, allowing anyone who can access the CAPTCHA image to decipher the correct answers. This vulnerability is particularly concerning given that it affects the default configuration of the extension, where the audio feature is enabled. As a result, forms dependent on this CAPTCHA mechanism for defense against bots can be easily exploited, leading to potential abuse and unauthorized submissions.

Affected Version(s)

Extension "Accessible Form Captcha" 4.0.0 < 5.4.2

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-030
vendor-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sven Rothe
Maik Schneider
.