Authentication Bypass in Drupal CAPTCHA by Acquia
CVE-2026-118582

7.3HIGH

Key Information:

Vendor

Drupal
Status
Captcha
Vendor
CVE Published:
30 October 2026

What is CVE-2026-118582?

A vulnerability in Drupal's CAPTCHA module allows attackers to bypass authentication checks through an alternate route, potentially enabling unauthorized actions. This issue affects all versions from 0.0.0 up to 1.18.0 and from 2.0.0 up to 2.0.11. Users are advised to update to the latest versions to protect against this vulnerability.

Affected Version(s)

CAPTCHA 0.0.0 < 1.18.0

CAPTCHA 2.0.0 < 2.0.11

References

https://www.drupal.org/sa-contrib-2026-281

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

James Gilliland (neclimdul)
Rodrigo Cabo (rodrigo-cabo)
Jakob P (japerry)
James Gilliland (neclimdul)
Rob Loach (robloach)
Swan Kalata (akalata)
Bram Driesen (bramdriesen)
Damien McKenna (damienmckenna)
Michael Hess (mlhess)
Juraj Nemec (poker10)
Pierre Rudloff (prudloff)
Stella Power (stella)
Jess (xjm)
.