CVE-2026-19030

Overview

Drupal is an open-source content management system known for its flexibility, robust features, and strong community support. Organizations of all sizes use it to build and manage dynamic websites and web applications.

CAPTCHA is a Drupal module that protects forms from automated submissions by adding human-verification challenges such as image, math, or reCAPTCHA tests. It integrates with common Drupal forms and lets administrators choose which forms are protected and which challenge type to use.

CAPTCHA is meant to act as a gate in front of a form's normal validation, especially on the login form: if a submitted CAPTCHA response is wrong, the form should stop there and reveal nothing else. On affected versions, that gate did not fully close — the module recorded the CAPTCHA failure but did not stop Drupal core from continuing to run the form's other validators, including login credential validation.

Broken Access Control occurs when an application fails to properly enforce restrictions on what authenticated users are allowed to do, enabling attackers to access unauthorized functionality, data, or resources. It often stems from inadequate validation of user permissions, allowing someone to bypass intended security boundaries and perform actions beyond their assigned role.

Any of the following ramifications are possible:

• Allowing arbitrary code execution
• Complete system compromise
• Data theft or exposure
• Data manipulation or destruction
• Privilege escalation, and
• Denial of service.

‍

Details

Module Info

• Product: Drupal 7
• Affected packages: CAPTCHA
• Affected versions: >=7.1.0 <=7.1.8
• Repository: https://git.drupalcode.org/project/captcha
• Published packages: https://www.drupal.org/project/captcha
• Package manager: composer
• Fixed in: CAPTCHA NES 7.1.9

Vulnerability Info

This medium-severity vulnerability is found in versions of the Drupal CAPTCHA module for Drupal 7 sites from 7.1.0 to 7.1.8 (inclusive).

When a CAPTCHA-protected login form (the login page or the login block) was submitted with an incorrect CAPTCHA response, the module called form_set_error() for the CAPTCHA field but did not suppress the form's other validators. Drupal core continued running normal login credential validation after the CAPTCHA failed.

As a result, the response shown to the visitor differed depending on whether the submitted username/password pair was valid:

• Invalid credentials + invalid CAPTCHA: both the CAPTCHA error and Drupal's "Sorry, unrecognized username or password" error were shown.
• Valid credentials + invalid CAPTCHA: only the CAPTCHA error was shown — because credential validation succeeded, even though the CAPTCHA still blocked the login.

This let an attacker use the CAPTCHA-protected login form as a credential oracle: by observing which error message appeared, they could test large numbers of username/password pairs and identify valid credentials without ever solving a CAPTCHA, defeating the brute-force protection CAPTCHA was meant to provide.

‍

Steps To Reproduce

1. Enable the CAPTCHA module (7.1.8, vulnerable).
2. Go to admin/config/people/captcha.
3. In the Form protection table, user_login is already listed by default — set its Challenge type dropdown to Math (from module captcha).
4. Under Persistence, select "Always add a challenge."
5. Click Save configuration.
6. Log out.
7. Go to the login page at user/login.
8. Submit the form with an invalid CAPTCHA response, an invalid username, and an invalid password.
9. Observe that the page shows both "The answer you entered for the CAPTCHA was not correct." and "Sorry, unrecognized username or password. Have you forgotten your password?"
10. Submit the form again with an invalid CAPTCHA response, a valid username, and that user's valid password.
11. Observe that only the CAPTCHA error is shown — confirming the credentials were valid, without ever solving the CAPTCHA.

Verification of Fix

After applying the patch, repeat the steps above. In both cases (valid and invalid credentials), only the CAPTCHA error is shown — no credential-validity signal is exposed.

‍

Addressing the Issue

Users of this module should apply one of the following mitigations:

• If the risk is unacceptable, disable CAPTCHA protection on affected workflows until the fix can be deployed.
• Add secondary abuse controls such as rate limiting (e.g. Drupal core's login flood control) or additional server-side validation on login forms.
• Restrict access to protected forms to trusted networks where possible.
• Sign up for post-EOL security support—HeroDevs customers get immediate access to a patched version of this module.

‍

Credits

• Swan Kalata (akalata)