Vvveb CMS: admins can read and overwrite other admins' API tokens
Any logged-in administrator of this website software can see and replace the login keys of other administrators. That lets one admin take over another admin's access to the site's automated tools.
| Severity | CriticalCVSS 9 of 10 |
|---|---|
| Being exploited? | UnclearNo reports either way yet |
| Fix available? | YesVersion 1.0.8.7 · since 30 Oct 2026 |
| How sure is this? | Official sourceBacked by an official source |
What happened
An authenticated Insecure Direct Object Reference (IDOR) on the admin/auth-token endpoint lets any administrator read and overwrite another administrator's API tokens in Vvveb CMS versions before 1.0.8.7.
Are you affected?
You are affected if you run Vvveb CMS older than 1.0.8.7 and have more than one administrator account.
Vvveb CMS versions prior to 1.0.8.7
What to do
- Update Vvveb CMS to version 1.0.8.7 or later
- Review API tokens of all administrator accounts for unexpected changes
- Rotate any API tokens if you suspect another admin account was misused
Timeline
- 30 Oct 2026, 15:16 UTCPublicly disclosed
- 30 Oct 2026, 15:16 UTCReported by NVD · NVD
- 30 Oct 2026, 15:18 UTCPicked up by Zero Radar
Sources 1 report, oldest first
Official vendor, government CERT or advisory database
- CVE-2026-112905NVD · 30 Oct 2026, 15:16 UTC
Technical details
- ID
- CVE-2026-112905
- CVSS
- 9 / 10
- Disclosed
- 30 Oct 2026, 15:16 UTC
- On Zero Radar
- 30 Oct 2026, 15:18 UTC (2 min after disclosure)
- Last change
- 30 Oct 2026, 15:18 UTC
The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works