Vvveb CVE-2026-41928

The cron controller must be accessible over the network and not protected by authentication or network-level access controls. By default, Vvveb installations do not require authentication to access the cron controller, and it is typically exposed as a public-facing endpoint to allow external task schedulers (cron services, monitoring tools) to trigger scheduled execution. Exploitation requires no authentication (PR:N in CVSS vector), no user interaction (UI:N), and no special configuration - the vulnerability exists in default deployments. The limiting factors are network accessibility to the controller endpoint and the absence of web server access restrictions (e.g., IP whitelisting or authentication middleware). If the cron controller is blocked at the firewall, disabled, or protected by reverse-proxy authentication, exploitation is prevented.

This vulnerability presents moderate but concrete risk. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L) correctly indicates network-accessible unauthenticated information disclosure with low attack complexity, yielding the 5.3 base score. Exploitation probability is high given the trivial attack (HTTP GET to cron controller), but impact is limited to confidentiality of the cron key itself, not system compromise. Real-world risk depends on what scheduled tasks exist and whether the attacker can use the exposed key to trigger harmful operations (e.g., database cleanup, email campaigns, or cache flush). The CVSS scope is Unchanged (S:U), meaning exploitation does not affect other users or resources directly. No EPSS score, KEV status, or public POC were provided, suggesting this is a lower-visibility disclosure. The primary concern is privilege escalation from unauthenticated to cron-task-executing capability, which may vary by deployment configuration.

An attacker sends a simple HTTP GET request to the Vvveb cron controller endpoint (e.g., http://target.com/app/controller/cron.php or equivalent) without authentication. The vulnerable version responds with the cron key embedded in a URL parameter in the response body. The attacker extracts this key and uses it in subsequent requests to trigger scheduled tasks, such as cache clearing, data exports, or administrative functions, outside their intended schedule to disrupt operations or exfiltrate data.