The vulnerability is an authentication bypass in onPhase Forms 11.0.14 that allows an attacker to impersonate any tenant user through the public registration form. By submitting a crafted request containing a valid tenant name and an existing user identifier, the attacker can elevate privileges to TenantAdmin and Designer, and then execute arbitrary operating system commands. This flaw is specifically a failure of authentication checks (CWE‑306) allowing remote code execution through the registration endpoint.

The affected product is onPhase Forms version 11.0.14. The vendor has released a fixed build, version 11.0.17, which removes the unauthenticated registration endpoint, enforces sandbox restrictions for rule execution, and disables the Document Service by default. Clients must apply the 11.0.17 update or follow the identified work‑arounds to mitigate the risk.

The CVSS score is 9.3, indicating critical severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog; however, the flaw remains highly exploitable because it can be triggered from any exposed instance of the affected application with only an unauthenticated HTTP request. Once exploited, the attacker gains full administrative privileges and can run arbitrary OS commands, making the potential impact extremely severe.