Vvveb CMS CVE-2026-110799

Requires network access to the Vvveb password-reset route (e.g. /user/reset/<anything>/<user>) on an instance running version 1.0.8.6 or earlier, which is the default/unpatched state. The attacker must supply a valid target user identifier in the request and inject a PHP array parameter (user[] and/or token[]) in place of the expected scalar token string; the advisory states the bypass works because the user and token GET parameters are passed to User::get() without is_string()/is_scalar() validation. No authentication, no valid reset token, and no user interaction are needed (PR:N/UI:N). The practical limiting factors are: the target must be an identifiable existing account, and the deployment must be an unpatched Vvveb instance - upgrading to 1.0.8.7 (the vendor fix) eliminates the flaw, which the advisory presents as the remediation alongside strict scalar input validation and strict token equality checks.

All available signals point the same direction for exploitability: the supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes remote, unauthenticated, low-complexity exploitation with high impact to confidentiality, integrity and availability (base 9.8), and the vuln.today Decision label is act_now. The GitHub Security Advisory (GHSA-qw5g-hcm8-9jcj) includes a step-by-step proof-of-concept with screenshots showing a single crafted URL dropping the attacker onto the password-reset screen, which is fully consistent with the AV:N/AC:L/PR:N/UI:N rating - the trigger is explicitly described as supplying PHP array parameters (user[]/token[]) that bypass token validation. No EPSS probability was provided in the input, and there is no CISA KEV entry, so active in-the-wild exploitation is NOT confirmed; the strong signals here are the trivial mechanics plus a public PoC, not observed attacks. The main factor that tempers real-world risk is deployment footprint: Vvveb is a niche open-source CMS, so this is a genuine act_now priority for anyone actually running it (trivial full account/admin takeover) rather than an internet-wide event. In short, this is a real, high-urgency issue for Vvveb operators, with the caveat that EPSS and KEV data are absent and cannot be cross-referenced.

A remote, unauthenticated attacker visits the password-reset endpoint for a known user (e.g. http://target/user/reset/anything/foo?token[]=), supplying a PHP array for the token parameter instead of a string. Because the user and token GET parameters are passed to User::get() without scalar-type validation, the lookup condition is satisfied without a valid token, and the attacker is taken straight to the 'enter new password' screen and sets a new password for the victim. A public step-by-step PoC with screenshots exists in the vendor advisory; the CVSS AV:N/AC:L/PR:N/UI:N rating confirms no authentication or user interaction is needed.