{"id":"DRUPAL-CONTRIB-2026-281","details":"The CAPTCHA module places a configurable challenge on forms to block automated submissions. To skip the challenge on later steps of the same multi-step form, the module remembers that a CAPTCHA session has been solved.\n\nThe module does not fully invalidate a solved CAPTCHA session. As a result, a protected form that was already submitted once can be submitted again without solving a new CAPTCHA. This weakens the protection the module provides against automated submissions such as spam registrations, comment spam, and login brute-forcing.\n\nThis is a follow-up to the earlier CAPTCHA replay fix ([SA-CONTRIB-2026-015](https://www.drupal.org/sa-contrib-2026-015) / CVE-2026-3214), which closed one replay path but left this one open.","aliases":["CVE-2026-118582"],"modified":"2026-10-28T18:15:02.682149310Z","published":"2026-10-28T17:27:47Z","references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-281"}],"affected":[{"package":{"name":"drupal/captcha","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/captcha?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0"}],"database_specific":{"constraint":"\u003c1.18.0"}},{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.11"}],"database_specific":{"constraint":"\u003e=2.0.0 \u003c2.0.11"}}],"database_specific":{"affected_versions":"\u003c1.18.0 || \u003e=2.0.0 \u003c2.0.11","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/captcha/DRUPAL-CONTRIB-2026-281.json"}}],"schema_version":"1.9.2","credits":[{"name":"James Gilliland (neclimdul)","contact":["https://www.drupal.org/u/neclimdul"]},{"name":"Rodrigo Cabo (rodrigo-cabo)","contact":["https://www.drupal.org/u/rodrigo-cabo"]}]}