CRITICAL 9.0 NVD

CVE-2026-112905

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, authenticated IDOR on admin/au

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, authenticated IDOR on admin/auth-token endpoint allows any administrator to read and overwrite another administrator's API tokens. This issue has been patched in version 1.0.8.7.

References

https://github.com/givanz/Vvveb/security/advisories/GHSA-hg48-r64v-9rvq

Published: 2026-10-30 · Source: NVD · Feed updated: 2026-10-30

This critical severity vulnerability with a CVSS score of 9.0 was published on 2026-10-30 via NVD.

Risk Timeline

CVE Disclosed2026-10-30 · -1 days ago

Remediation Resources

GitHub

github.com/givanz/Vvveb/security/advisories/GHSA-hg48-r64v-9rvq

vulnfeed aggregates 17712 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.