CVE-2026-112905: Vvveb Admin API Token IDOR
CVE-2026-112905 is an insecure direct object reference (IDOR) in Vvveb, an open-source CMS and page builder. The admin/auth-token endpoint allows any authenticated administrator to read and overwrite another administrator's API tokens. The flaw is rated CVSS 9.0 and was published on 2026-10-30.
It is fixed in Vvveb 1.0.8.7.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-112905 |
| CVSS Score | 9.0 (Critical) |
| Weakness | Insecure Direct Object Reference (IDOR) |
| Affected Product | Vvveb CMS |
| Affected Versions | Versions before 1.0.8.7 |
| Fixed Version | 1.0.8.7 |
| Authentication Required | Yes, administrator account |
| Published | 2026-10-30 |
Impact
The endpoint does not verify that the token being read or modified belongs to the requesting administrator. In multi-administrator deployments, one admin, or an attacker who has compromised any single admin account, can:
- Read other administrators' API tokens
- Overwrite those tokens with attacker-chosen values
- Use the harvested tokens to act as the other administrators through the API
Single-admin sites are less exposed, but the bug turns one compromised admin account into compromise of all of them. It pairs naturally with CVE-2026-110799, the unauthenticated password reset bypass fixed in the same release.
Remediation
- Upgrade Vvveb to 1.0.8.7 or later.
- After upgrading, rotate all administrator API tokens, since earlier tokens may have been read.
- Review the list of administrator accounts and remove any you do not recognize.
- Limit the admin panel to trusted networks where possible.
Key Takeaways
- CVE-2026-112905 is a CVSS 9.0 IDOR in Vvveb's admin API token endpoint
- Any administrator can read and overwrite other administrators' tokens
- Upgrade to 1.0.8.7 and rotate API tokens afterward
- Patch together with CVE-2026-110799 on the same instances