EUVD Vulnerability Catalog
EUVD-2026-108564
Severity: CRITICAL
Base Score: 9.3
CVSS Version: 4.0
Vulnerability Description
An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary operating system commands via manipulation of registration parameters containing a valid tenant name and existing user identifier.
CVSS Vector Analysis
Below is the complete, human-readable breakdown of the CVSS metric string: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
▪
Attack Vector (AV): Network
▪
Attack Complexity (AC): Low
▪
Attack Requirements (AT): None
▪
Privileges Required (PR): None
▪
User Interaction (UI): None
▪
Vulnerability Confidentiality Impact (VC): High
▪
Vulnerability Integrity Impact (VI): High
▪
Vulnerability Availability Impact (VA): High
▪
Subsequent Confidentiality Impact (SC): None
▪
Subsequent Integrity Impact (SI): None
▪
Subsequent Availability Impact (SA): None
Affected Vendors & Systems
Vendor
onPhase
References & Advisory Links
Metadata Profile
Database Authority
European Union Agency for Cybersecurity (ENISA) EUVD
Assigner
MON-CSIRT
EPSS Probability
0
Known Aliases
CVE-2026-19677
GHSA-542f-hr4v-mv7f
Published On
2026-10-23
Last Updated
2026-10-23