CVE-2026-29789: Vito Auth Bypass Vulnerability

CVE-2026-29789 Overview

CVE-2026-29789 is a critical missing authorization vulnerability (CWE-862) in Vito, a self-hosted web application designed to help manage servers and deploy PHP applications into production environments. Prior to version 3.20.3, a missing authorization check in workflow site-creation actions allows an authenticated attacker with workflow write access in one project to create and manage sites on servers belonging to other projects by supplying a foreign server_id. This represents a severe broken access control flaw that enables cross-project unauthorized access.

Critical Impact

Authenticated attackers can bypass project isolation boundaries to create and manage sites on servers they should not have access to, potentially compromising multi-tenant deployments and enabling unauthorized code deployment to production servers.

Affected Products

• Vito (self-hosted web application) versions prior to 3.20.3
• Vito workflow site-creation module
• Vito server management components

Discovery Timeline

• 2026-03-06 - CVE CVE-2026-29789 published to NVD
• 2026-03-09 - Last updated in NVD database

Technical Details for CVE-2026-29789

Vulnerability Analysis

This vulnerability stems from insufficient authorization checks within Vito's workflow site-creation functionality. The application fails to verify that a user performing site creation operations has appropriate permissions for the target server specified by server_id. This allows authenticated users who possess workflow write access within their own project to manipulate requests and target servers belonging to entirely different projects.

The flaw represents a classic horizontal privilege escalation scenario where project isolation boundaries are not properly enforced at the server level. When a user submits a site creation request, the application processes the provided server_id parameter without validating that the server belongs to a project where the user has legitimate access.

Root Cause

The root cause is a missing authorization check (CWE-862: Missing Authorization) in the workflow site-creation actions. The vulnerable code path accepts and processes server_id parameters without validating project ownership or membership. The application assumes that if a user has workflow write access in any project, they should be able to specify any server ID, rather than restricting operations to servers within their authorized project scope.

Attack Vector

The attack vector is network-based and requires low privileges (authenticated access with workflow write permissions). An attacker can exploit this vulnerability by:

1. Authenticating to the Vito application with an account that has workflow write access to at least one project
2. Identifying or enumerating server IDs belonging to other projects (through API responses, error messages, or sequential ID guessing)
3. Crafting a site creation request that includes a foreign server_id parameter pointing to a target server in another project
4. Submitting the malicious request to create or manage sites on the unauthorized server

The vulnerability allows attackers to deploy potentially malicious PHP applications to production servers they should not have access to, effectively bypassing the multi-project isolation model that Vito provides.

Detection Methods for CVE-2026-29789

Indicators of Compromise

• Unexpected site creation logs showing server_id values that do not belong to the initiating user's project
• Audit logs revealing cross-project server access patterns
• New sites appearing on servers without corresponding authorized user activity
• Workflow execution logs showing mismatched project and server associations

Detection Strategies

• Implement monitoring for site creation API requests where the server_id does not match servers within the authenticated user's project scope
• Review application logs for patterns of sequential server_id enumeration attempts
• Correlate user authentication tokens with server ownership to identify unauthorized cross-project access
• Deploy web application firewall rules to flag anomalous server targeting patterns

Monitoring Recommendations

• Enable detailed audit logging for all site creation and server management operations
• Monitor for unusual patterns of API calls attempting to reference servers across project boundaries
• Set up alerts for failed authorization checks that may indicate exploitation attempts
• Review access logs for authenticated users accessing resources outside their normal project scope

How to Mitigate CVE-2026-29789

Immediate Actions Required

• Upgrade Vito to version 3.20.3 or later immediately
• Audit existing sites on all servers to identify any unauthorized deployments created through exploitation
• Review server configurations for unauthorized changes or malicious code deployments
• Temporarily restrict workflow write access to trusted administrators until the patch is applied

Patch Information

The vulnerability has been patched in Vito version 3.20.3. The fix adds proper authorization checks to validate that users can only perform site-creation operations on servers belonging to projects where they have legitimate access.

Patch details are available in the following resources:

• GitHub Commit 0fdcfe5
• GitHub Pull Request #1036
• GitHub Release v3.20.3
• GitHub Security Advisory GHSA-3m6w-8qh4-qr76

Workarounds

• If immediate patching is not possible, restrict workflow write permissions to only essential personnel
• Implement network segmentation to limit cross-project server access at the infrastructure level
• Deploy application-level firewall rules to validate server ownership on incoming requests
• Consider temporarily disabling the workflow site-creation feature until the patch can be applied

# Update Vito to patched version
cd /path/to/vito
git fetch origin
git checkout tags/3.20.3
composer install --no-dev
php artisan migrate
php artisan config:cache