CVE-2026-41928: Vvveb < 1.0.8.2 Information Disclosure via Cron Controller
Vvveb before 1.0.8.2 contains an information disclosure vulnerability in the cron controller that allows unauthenticated attackers to retrieve the application's secret cron key. Attackers can access the cron controller without authentication and retrieve the exposed secret key from the response, enabling them to trigger scheduled task execution outside of the intended schedule.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vvvebto a version that resolves this vulnerability.Fixed in 1.0.8.2 - Operational
After upgrading Vvveb to 1.0.8.2, rotate the application's secret cron key because it could have been exposed by unauthenticated access to the cron controller before 1.0.8.2.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41928?
The severity of CVE-2026-41928 is considered high due to the potential for unauthorized information disclosure.
How do I fix CVE-2026-41928?
To fix CVE-2026-41928, upgrade to Vvveb version 1.0.8.2 or later where the vulnerability has been patched.
What information can be disclosed through CVE-2026-41928?
CVE-2026-41928 allows unauthenticated attackers to retrieve the application's secret cron key, which can lead to further exploitation.
Which versions of Vvveb are affected by CVE-2026-41928?
CVE-2026-41928 affects all versions of Vvveb prior to 1.0.8.2.
Is authentication required to exploit CVE-2026-41928?
No, authentication is not required to exploit CVE-2026-41928, making it particularly dangerous.