CVE-2026-112067: CWE-804 Guessable CAPTCHA in TYPO3 Extension "Accessible Form Captcha"
Description
The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself. Anyone who can request a CAPTCHA image can read the answer from it and submit it, so automated clients can pass the challenge. This applies to the default configuration, because the audio feature that causes the answer to be embedded is enabled by default. Forms that rely on the CAPTCHA as their only protection against automated submissions are exposed to abuse by bots.
CVSS v4.0
Score 6.9medium
Affected software
TYPO3
Extension "Accessible Form Captcha"
pkg:composer/blueways/bw-captchaRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-112067 describes a guessable CAPTCHA vulnerability in the TYPO3 extension "Accessible Form Captcha". The extension embeds the correct CAPTCHA answer inside the image data, making it accessible to anyone who can request the CAPTCHA image. This design flaw allows automated clients to bypass the CAPTCHA challenge by reading the embedded answer. The issue affects versions >=4.0.0 and <5.4.2, with the audio feature enabled by default causing the embedding of the answer. This vulnerability is classified under CWE-804 (Access of Resource Using Incorrectly Controlled Reference) and CWE-656 (Incorrect Usage of CAPTCHA).
Potential Impact
Automated clients can bypass the CAPTCHA protection by extracting the answer from the CAPTCHA image data, enabling abuse of forms that rely solely on this CAPTCHA for protection against automated submissions. This undermines the effectiveness of the CAPTCHA, potentially leading to increased spam or automated attacks on affected forms.
Mitigation Recommendations
No official patch or remediation is currently provided. Users should check the vendor advisory for updates. Until a fix is available, relying solely on this CAPTCHA for protection against automated submissions is not recommended. Consider implementing additional anti-automation controls or disabling the audio feature that embeds the answer if configurable.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- TYPO3
- Date Reserved
- 2026-10-18T12:08:05.799Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad739152cdf04f6561b796b
Added to database: 10/20/2026, 09:49:09 UTC
Last enriched: 10/20/2026, 10:04:13 UTC
Last updated: 10/20/2026, 19:34:20 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.