CVE-2026-112905: Vvveb: Authenticated IDOR on admin/auth-token Allows Admin Privilege Escalation via API Token Theft
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, authenticated IDOR on admin/auth-token endpoint allows any administrator to read and overwrite another administrator's API tokens. This issue has been patched in version 1.0.8.7.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vvvebto a version that resolves this vulnerability.Fixed in 1.0.8.7
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated administrator can exploit the IDOR on the admin/auth-token endpoint. The vulnerability allows one administrator to access and replace another administrator's API tokens.
Which deployments are affected?
Vvveb versions prior to 1.0.8.7 are affected. Version 1.0.8.7 contains the patch.
What is the likely impact of successful exploitation?
An attacker with administrator access can steal another administrator's API token and overwrite it. The reported impact includes escalation of administrative privilege through API token theft.