CVE-2026-126323: Vvveb through 1.0.8.6 CSRF via GET Admin State-Changing Actions
Vvveb through 1.0.8.6 contains a cross-site request forgery vulnerability that allows attackers to perform admin state-changing actions because checkCsrf() in admin/controller/base.php only validates tokens for POST requests. Attackers can lure a logged-in admin into loading a forged cross-site GET request to delete admin/user accounts, sites, orders, and menus or change comment status.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Administrators who are logged in to a Vvveb instance are exposed if they can be induced to load a forged cross-site GET request. The attacker does not need credentials, but the targeted browser session must have administrative access.
Which actions can an attacker trigger?
A forged request can perform administrative state-changing actions, including deleting administrator or user accounts, sites, orders, and menus, and changing comment status.
Are GET-based administrative actions protected by CSRF token validation?
No. The affected checkCsrf() logic in admin/controller/base.php validates tokens only for POST requests, allowing state-changing GET requests to bypass that validation.