How severe is CVE-2026-112067?

CVE-2026-112067 has a CVSS 4.0 base score of 6.9, rated medium severity.

Is CVE-2026-112067 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (30th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-112067?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2026-112067 published?

CVE-2026-112067 was published on 2026-10-20.

CVE-2026-112067

CVE-2026-112067 is a medium-severity vulnerability with a CVSS 4.0 base score of 6.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-656.

Key facts

Severity: Medium (CVSS 4.0 base score 6.9)
EPSS exploit prediction: 0% (30th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-656
Published: 2026-10-20
Last modified: 2026-10-20

Description

The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself. Anyone who can request a CAPTCHA image can read the answer from it and submit it, so automated clients can pass the challenge. This applies to the default configuration, because the audio feature that causes the answer to be embedded is enabled by default. Forms that rely on the CAPTCHA as their only protection against automated submissions are exposed to abuse by bots.

Frequently asked questions

What is CVE-2026-112067?: The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself. Anyone who can request a CAPTCHA image can read the answer from it and submit it, so automated clients can pass the challenge. This applies to the default configuration, because the audio feature that causes the answer to be embedded is enabled by default. Forms that rely on the CAPTCHA as their only protection against automated submissions are exposed to abuse by bots.
How severe is CVE-2026-112067?: CVE-2026-112067 has a CVSS 4.0 base score of 6.9, rated medium severity.
Is CVE-2026-112067 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (30th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-112067?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2026-112067 published?: CVE-2026-112067 was published on 2026-10-20.

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-030

Other CWE-656 vulnerabilities

CVE-2026-7161 — Critical (CVSS 9.3): An insufficient encryption vulnerability exists in the Device Authentication functionality of GeoVision GV-IP Device…
CVE-2026-42363 — Critical (CVSS 9.3): An insufficient encryption vulnerability exists in the Device Authentication functionality of GeoVision GV-IP Device…
CVE-2024-12297 — Critical (CVSS 9.2): Moxa’s Ethernet switch is vulnerable to an authentication bypass because of flaws in its authorization mechanism.…
CVE-2020-10284 — Critical (CVSS 9.1): No authentication is required to control the robot inside the network, moreso the latest available user manual shows an…
CVE-2025-59093 — High (CVSS 8.5): Exos 9300 instances are using a randomly generated database password to connect to the configured MSSQL server. The…
CVE-2024-9138 — High (CVSS 7.2): Moxa’s cellular routers, secure routers, and network security appliances are affected by a high-severity…

Browse all CWE-656 vulnerabilities →