Vvveb: Authenticated IDOR on admin/auth-token Allows Admin Privilege Escalation via API Token Theft
Affects Vvveb 1.0.8.6, where any logged-in administrator can read and overwrite another administrator's API tokens. Fixed in 1.0.8.7.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 1.0.8.7
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Vvveb, an open-source content management system with a page builder for websites, blogs, and ecommerce stores, is affected. An authenticated attacker with administrator access can exploit a flaw in the authentication token endpoint to read and overwrite other administrators' API tokens, which could let them take over higher-privileged accounts.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, authenticated IDOR on admin/auth-token endpoint allows any administrator to read and overwrite another administrator's API tokens. This issue has been patched in version 1.0.8.7.
Timeline
- CVE published
- First seen by cve.now
- Posted on X by cve.now
Affected versions
- givanz Vvveb
fixed in 1.0.8.7
References 1
GitHub · givanz/Vvveb
Questions about CVE-2026-112905
What does this mean?
An administrator can change the admin_id in a URL on the admin/auth-token endpoint and read another administrator's REST API tokens. They can also overwrite those tokens, which locks the victim out and may give the attacker the victim's higher privileges.Source: github.com
Am I affected, and how do I check?
The listed affected version is Vvveb 1.0.8.6, and the attacker needs an authenticated administrator account. To check, compare the installed Vvveb version number with 1.0.8.6.Source: github.com
What should I do about it?
Upgrade to Vvveb 1.0.8.7, the listed fixed version.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data