A server‑side request forgery flaw exists in the unauthenticated form service of onPhase Forms version 11.0.14, allowing a remote attacker to supply a crafted URL that the server will request internally. This can expose sensitive data from the internal Apache Solr instance, including configuration, indices, or documents that should remain private. The weakness is identified as CWE‑918.

The affected product is onPhase Forms, specifically version 11.0.14. Upgrading to 11.0.17 or later removes the vulnerable endpoint, introduces sandbox rules that block access to unapproved Java classes, and disables the Document Service endpoint by default to prevent SSRF. If an upgrade is not possible immediately, the registration endpoint (/frevvo/web/webapp/register) and any /frevvo/web//service endpoints should be blocked at a reverse proxy or web application firewall.

The CVSS score of 8.7 indicates high severity. Because the attack surface is a publicly reachable form that is unauthenticated, an exploit can be performed remotely by submitting a crafted URL. EPSS is not available and the vulnerability is not listed in CISA KEV, but the potential for internal data leakage remains significant. The vulnerability allows a remote attacker to reach internal Solr services without authentication, exposing sensitive data.