CVE-2026-81168

BASSO 3.7CVE-2026-81168 · DRUPAL-CONTRIB-2026-105 · Published 02/09/2026 · updated 09/09/2026

In breve

CVE-2026-81168 è una vulnerabilità BASSO (CVSS 3.7) che riguarda drupal/captcha_protected_page, captcha protected page (captcha protected page project).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.32%, superiore al 25.0% delle vulnerabilità.
Correzione: aggiornare a 1.0.2 o successiva.

Package	Affected versions	Patched versions
drupal/captcha_protected_page Packagist:https://packages.drupal.org/8	`< 1.0.2`	`1.0.2`
captcha protected page captcha_protected_page_project	`< 1.0.2`	`1.0.2`

Description

This module enables site administrators to require CAPTCHA confirmation on specific pages.

The module does not sufficiently validate its CAPTCHA verification cookies. Under certain circumstances, an unauthenticated user or automated bot can forge the cookie and bypass CAPTCHA verification entirely.

NVD description

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA Protected Page versions: from 0.0.0 to 1.0.2.

References

drupal.org/sa-contrib-2026-105 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free