CVE-2026-46407: Vvveb CMS Information Disclosure Flaw

CVE-2026-46407 Overview

Vvveb is an open source content management system (CMS) with an integrated page builder for websites, blogs, and ecommerce stores. CVE-2026-46407 is an Insecure Direct Object Reference [CWE-639] flaw in the admin/auth-token backend endpoint. An authenticated administrator can supply another administrator's admin_id and retrieve that user's REST API token list. The flaw exposes API tokens belonging to other administrators, enabling lateral movement against the application's REST API. Vvveb versions prior to 1.0.8.3 are affected, and the issue is fixed in 1.0.8.3.

Critical Impact

An authenticated administrator can disclose REST API tokens belonging to any other administrator, enabling impersonation and unauthorized access to administrative REST API functions.

Affected Products

• Vvveb CMS versions prior to 1.0.8.3
• Vvveb backend admin/auth-token endpoint
• Deployments exposing the Vvveb admin interface to multiple administrator accounts

Discovery Timeline

• 2026-05-15 - CVE-2026-46407 published to the National Vulnerability Database (NVD)
• 2026-05-18 - Last updated in NVD database

Technical Details for CVE-2026-46407

Vulnerability Analysis

The vulnerability resides in the Vvveb backend admin/auth-token endpoint. The endpoint accepts an admin_id parameter and returns the REST API token list associated with that identifier. The server authenticates the requester but fails to verify that the supplied admin_id matches the requester's own account. Any authenticated administrator can therefore request token lists belonging to other administrators. The disclosed tokens grant programmatic access to the REST API with the privileges of the impersonated administrator. This issue is categorized as Insecure Direct Object Reference [CWE-639].

Root Cause

The root cause is a missing authorization check on the admin_id parameter in the admin/auth-token handler. The application treats authentication as sufficient and does not enforce object-level ownership on the requested resource. Direct references to other administrator records are honored without validation.

Attack Vector

Exploitation requires network access to the admin interface and valid administrator credentials. The attacker submits a request to admin/auth-token while substituting the admin_id value with the identifier of a target administrator. The response contains the target's REST API tokens. The attacker can then authenticate to the REST API as the target administrator and perform actions permitted by that account.

// No verified public exploit code is available for CVE-2026-46407.
// See the GitHub Security Advisory referenced below for technical details.

Detection Methods for CVE-2026-46407

Indicators of Compromise

• Requests to admin/auth-token where the supplied admin_id does not match the session's authenticated administrator identifier.
• Unexpected REST API activity authenticated with tokens belonging to administrators who did not generate or use them recently.
• Multiple sequential admin/auth-token requests from a single session iterating through incrementing admin_id values.

Detection Strategies

• Enable detailed access logging on the Vvveb admin interface and parse logs for admin/auth-token requests, correlating admin_id parameters with session identity.
• Alert on any authenticated session that retrieves token data for an admin_id other than its own.
• Compare REST API authentication events against the issuing administrator's typical source IP, user agent, and time-of-day baseline.

Monitoring Recommendations

• Forward web server and application logs to a centralized logging platform and retain them long enough to investigate token misuse after the fact.
• Monitor for creation, listing, or revocation of API tokens outside of normal administrator workflows.
• Review administrator account activity periodically and rotate REST API tokens on a defined schedule.

How to Mitigate CVE-2026-46407

Immediate Actions Required

• Upgrade Vvveb to version 1.0.8.3 or later, which contains the authorization fix for the admin/auth-token endpoint.
• Revoke and reissue all existing REST API tokens for every administrator account after upgrading.
• Audit administrator accounts and remove any that are unused or unrecognized.
• Review REST API logs for activity that may indicate prior token disclosure or misuse.

Patch Information

The maintainers fixed CVE-2026-46407 in Vvveb 1.0.8.3. Details and the patch reference are published in the Vvveb GitHub Security Advisory GHSA-5g3g-x6mf-pwr6.

Workarounds

• Restrict access to the Vvveb admin interface using network controls such as IP allow lists or a VPN until the upgrade is applied.
• Reduce the number of administrator accounts to the minimum required and enforce strong authentication on each.
• Temporarily disable or revoke REST API tokens for administrators who do not require API access.

# Example: restrict admin interface access at the web server layer (nginx)
location /admin/ {
    allow 10.0.0.0/24;
    deny  all;
    proxy_pass http://vvveb_backend;
}