← CVE index
Vulnerability record/PUBLISHED/Published Oct 30, 2026 03:08:46 UTC

CVE-2026-118582

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass. This issue affects CAPTCHA versions: from 0.0.0 to 1.18.0, from 2.0.0 to 2.0.11.

Base score7.3/ 10
SeverityHighCVSS 3.1

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes
Base severityHigh
Attack vectorNetworkAV
Attack complexityLowAC
Privileges requiredNonePR
User interactionNoneUI
ScopeUnchangedS
Confidentiality impactLowC
Integrity impactLowI
Availability impactLowA
CVSS vector stringCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering Authoritydrupal
Last updatedNov 6, 2026 13:46:40 UTC
PublishedOct 30, 2026 03:08:46 UTC
ReservedOct 28, 2026 16:08:24 UTC

Credits

  • James Gilliland (neclimdul)
  • Rodrigo Cabo (rodrigo-cabo)
  • Jakob P (japerry)
  • James Gilliland (neclimdul)
  • Rob Loach (robloach)
  • Swan Kalata (akalata)
  • Bram Driesen (bramdriesen)
  • Damien McKenna (damienmckenna)
  • Michael Hess (mlhess)
  • Juraj Nemec (poker10)
  • Pierre Rudloff (prudloff)
  • Stella Power (stella)
  • Jess (xjm)