CVE-2026-112905

Summary

Authenticated IDOR in the admin/auth-token endpoint allows any administrator to read and overwrite other administrators' API tokens due to missing authorization checks.

Exploitability

Exploitation requires valid administrator credentials; no privilege escalation is needed beyond being an admin.

Blast radius

Compromised API tokens could enable attackers to impersonate other admins, exfiltrate sensitive data, modify site content, or deploy malicious code across the CMS.

Detection

Monitor for anomalous API token access patterns—e.g., an admin querying or modifying tokens not associated with their user account—via server logs of the /admin/auth-token endpoint.

Prioritized remediation

Upgrade to Vvveb version 1.0.8.7 or later, which patches the IDOR vulnerability in the admin/auth-token endpoint.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.