CVE-2026-19030

Overview

Drupal is an open-source content management system known for its flexibility, robust features, and strong community support. Organizations of all sizes use it to build and manage dynamic websites and web applications.

CAPTCHA is a Drupal module that protects forms from automated submissions by adding human-verification challenges such as image, math, or reCAPTCHA tests. It integrates with common Drupal forms and lets administrators choose which forms are protected and which challenge type to use.

CAPTCHA is meant to act as a gate in front of a form's normal validation, especially on the login form: if a submitted CAPTCHA response is wrong, the form should stop there and reveal nothing else. On affected versions, that gate did not fully close — the module recorded the CAPTCHA failure but did not stop Drupal core from continuing to run the form's other validators, including login credential validation.

Broken Access Control occurs when an application fails to properly enforce restrictions on what authenticated users are allowed to do, enabling attackers to access unauthorized functionality, data, or resources. It often stems from inadequate validation of user permissions, allowing someone to bypass intended security boundaries and perform actions beyond their assigned role.

Any of the following ramifications are possible:

• Allowing arbitrary code execution
• Complete system compromise
• Data theft or exposure
• Data manipulation or destruction
• Privilege escalation, and
• Denial of service.

Details

Module Info

• Product: Drupal 7
• Affected packages: CAPTCHA
• Affected versions: >=7.1.0 <=7.1.8
• Repository: https://git.drupalcode.org/project/captcha
• Published packages: https://www.drupal.org/project/captcha
• Package manager: composer
• Fixed in: CAPTCHA NES 7.1.9

Vulnerability Info

This medium-severity vulnerability is found in versions of the Drupal CAPTCHA module for Drupal 7 sites from 7.1.0 to 7.1.8 (inclusive).

When a CAPTCHA-protected login form (the login page or the login block) was submitted with an incorrect CAPTCHA response, the module called form_set_error() for the CAPTCHA field but did not suppress the form's other validators. Drupal core continued running normal login credential validation after the CAPTCHA failed.

As a result, the response shown to the visitor differed depending on whether the submitted username/password pair was valid:

• Invalid credentials + invalid CAPTCHA: both the CAPTCHA error and Drupal's "Sorry, unrecognized username or password" error were shown.
• Valid credentials + invalid CAPTCHA: only the CAPTCHA error was shown — because credential validation succeeded, even though the CAPTCHA still blocked the login.

This let an attacker use the CAPTCHA-protected login form as a credential oracle: by observing which error message appeared, they could test large numbers of username/password pairs and identify valid credentials without ever solving a CAPTCHA, defeating the brute-force protection CAPTCHA was meant to provide.

Addressing the Issue

Users of this module should apply one of the following mitigations:

• If the risk is unacceptable, disable CAPTCHA protection on affected workflows until the fix can be deployed.
• Add secondary abuse controls such as rate limiting (e.g. Drupal core's login flood control) or additional server-side validation on login forms.
• Restrict access to protected forms to trusted networks where possible.
• Sign up for post-EOL security support—HeroDevs customers get immediate access to a patched version of this module.

Credits

• Swan Kalata (akalata)