CVE-2026-112905

LOWCVSS 9.0 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, authenticated IDOR on admin/auth-token endpoint allows any administrator to read and overwrite another administrator's API tokens. This issue has been patched in version 1.0.8.7.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://github.com/givanz/Vvveb/security/advisories/GHSA-hg48-r64v-9rvq

Weakness type (CWE)

CWE-285

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

2 mentions across 1 observed day

What's happening

2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Referenced assets2 URLs

By indicator

Full discourse2 posts

curiosus curans@_MultiCS_1d
Une faille IDOR critique dans le CMS Vvveb permet à un admin lambda de voler les tokens API des patrons et de s'octroyer les pleins pouvoirs. De quoi transformer ton site e-commerce en passoire VIP avant même d'avoir fini ton café. https://cvefeed.io/vuln/detail/CVE-2026-112905
0000034
124 followersView on X
cve.now@cvedotnow1d
🔴 givanz Vvveb 1.0.8.7 fixes 2 critical CVEs Worst: account takeover via auth bypass in password reset (CVE-2026-110799) Patch → 1.0.8.7 https://cve.now/CVE-2026-110799?release=CVE-2026-112905&utm_source=x&utm_medium=social&utm_campaign=cvedotnow&utm_content=rollup
00000543
18.2K followersView on X

Explore more

Back to dashboard