ApostropheCMS allows an attacker to craft a CAPTCHA response token that is inserted into the verification request without URL‑encoding. This flaw can smuggle additional request parameters, potentially disrupting CAPTCHA verification or enabling automated probing. No confirmed successful bypass or secret disclosure has been demonstrated, but the integrity of CAPTCHA‑gated form or login flows is compromised.

Any installation using the @apostrophecms/form add‑on older than version 1.5.5, the @apostrophecms/login‑recaptcha plugin older than 1.2.1, or the @apostrophecms/login‑hcaptcha plugin older than 1.3.0 – all components of ApostropheCMS available from the @apostrophecms organization.

The CVSS score of 5.3 indicates a moderate severity. EPSS data is unavailable and the issue is not listed in the CISA KEV catalog, which lowers the perceived likelihood of widespread exploitation. The vulnerability is exploitable by submitting a crafted CAPTCHA token through the affected form or login page, so it requires user interaction to trigger, though automated probing is possible.