CVE-2026-112067: Captcha Bypass in extension "Accessible Form Captcha" (bw_captcha)
Vulnerability summary
CVE-2026-112067 is a medium (CVSS 6.9) Guessable CAPTCHA vulnerability in typo3 extension "accessible form captcha". EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 31.4% of scored vulnerabilities.
Not severe (CVSS 6.9, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Timeline
- 20-10-2026PublishedVulnerability first disclosed.
- 24-10-2026Last modifiedVulnerability information updated.
Description
The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself. Anyone who can request a CAPTCHA image can read the answer from it and submit it, so automated clients can pass the challenge. This applies to the default configuration, because the audio feature that causes the answer to be embedded is enabled by default. Forms that rely on the CAPTCHA as their only protection against automated submissions are exposed to abuse by bots.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.38%
Chance of exploitation in the next 30 days
Percentile
31%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-804Guessable CAPTCHAThe product uses a CAPTCHA challenge, but the challenge can be guessed or automatically recognized by a non-human actor.
- CWE-656Reliance on Security Through ObscurityThe product uses a protection mechanism whose strength depends heavily on its obscurity, such that knowledge of its algorithms or key data is sufficient to defeat the mechanism.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Typo31 product
- extension "accessible form captcha"≥ 4.0.0, < 5.4.2
1 vendor · 1 product
References
1 links- typo3.org/security/advisory/typo3-ext-sa-2026-030Vendor Advisory