Executive brief
Vvveb is a content management system (CMS) used to build and manage websites and e-commerce stores. A security flaw in the administrative interface allows a user with low-level administrative access to view the secret API tokens of other administrators. An attacker could use these stolen tokens to gain unauthorized access to sensitive site data or perform actions on behalf of higher-privileged users.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in Vvveb CMS prior to version 1.0.8.3. The 'admin/auth-token' endpoint fails to validate that the 'admin_id' parameter provided in the request matches the session of the authenticated user. By manipulating this parameter, a low-privileged administrator can query and view the plaintext REST API tokens of any other administrator. This bypasses intended isolation between administrative accounts and allows for horizontal or vertical privilege escalation via the REST API. The issue is rooted in the 'index' function of the 'admin/auth-token.php' controller, which directly uses user-supplied input to filter database queries without sufficient authorization checks.
Affected products
- givanz Vvveb < 1.0.8.3
Timeline
- 2026-05-13: advisory: GitHub Security Advisory published by vendor
- 2026-05-15: disclosed: CVE published to NVD
- 2026-05-15: patched: Vulnerability fixed in version 1.0.8.3