Which versions of Vvveb are affected by CVE-2026-41935?

CVE-2026-41935 affects Vvveb admin controllers and enables authenticated low-privilege users to trigger infinite recursion that exhausts PHP worker memory, causing complete denial of service across…. A patch is available.

How to fix or mitigate CVE-2026-41935?

Within 24 hours: inventory all Vvveb installations and identify current versions below 1.0.8.3; disable or restrict access to admin controller endpoints for non-administrator accounts via web application firewall or reverse proxy rules. Within 7 days: upgrade all affected Vvveb instances to version 1.0.8.3 or later; verify the upgrade by confirming commit c766e84b is present in deployed code. Within 30 days: conduct post-upgrade testing of admin permission enforcement; review access logs for exploitation attempts from low-privilege accounts during the patching window.

Vvveb CVE-2026-41935

Q: What is the CVSS score of CVE-2026-41935?

CVE-2026-41935 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-30293 HIGH

Error Message Information Leak (CWE-209)

2026-05-14 disclosure@vulncheck.com

GHSA-gpm5-vv3g-pcjf

Denial Of Service PHP Information Disclosure

7.1

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (vulncheck) · only source for this CVE.

CVSS VectorVendor: vulncheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

May 14, 2026 - 16:01 EUVD

Source Code Evidence Fetched

May 14, 2026 - 15:31 vuln.today

Analysis Generated

May 14, 2026 - 15:31 vuln.today

CVE Published

May 14, 2026 - 15:16 nvd

HIGH 7.1

DescriptionCVE.org

Vvveb before 1.0.8.3 contains an uncontrolled recursion vulnerability in the admin controller dispatch cycle where Base::init() repeatedly invokes permission() on error handlers, causing infinite recursion until PHP memory limits are exhausted. Attackers can send sustained requests to forbidden admin URLs from a low-privilege account to exhaust PHP memory on all workers and cause denial of service to legitimate traffic.

AnalysisAI

Infinite recursion in Vvveb admin controller exhausts PHP memory through repeated permission checks when low-privilege users access forbidden admin URLs. Sustained requests deplete worker memory causing site-wide denial of service. Fixed in version 1.0.8.3 via commit c766e84b which removes Base class inheritance from Error403 controller to break the dispatch cycle. No evidence of active exploitation but trivial to reproduce with authenticated low-privilege account.

Technical ContextAI

Vvveb is a PHP-based website builder and CMS. The vulnerability exploits a circular dependency in the MVC controller dispatch chain where the Base::init() method calls permission() to validate access rights. When permission checks fail, Vvveb routes to the Error403 controller which inherits from Base, triggering Base::init() again. This creates unbounded recursion: Base::init() → permission() → Error403 controller → Base::init() (inherited) → permission() → Error403 → repeating until PHP's memory_limit is exceeded. CWE-209 (Information Exposure Through Error Message) is listed but the primary weakness is CWE-674 (Uncontrolled Recursion). The commit diff confirms the fix removes 'extends Base' from Error403, preventing inheritance of init() and breaking the recursion loop.

RemediationAI

Upgrade to Vvveb 1.0.8.3 or later immediately via https://github.com/givanz/Vvveb/releases/tag/1.0.8.3. The fix removes Base class inheritance from Error403 controller, eliminating recursive init() calls. If immediate upgrade is not feasible, implement compensating controls: (1) Apply PHP memory_limit restrictions per worker combined with short max_execution_time to fail-fast on recursion attempts, limiting blast radius (trade-off: may cause false positives on legitimate heavy operations). (2) Deploy WAF rules to rate-limit repeated 403 responses from same authenticated session within short time windows - flag sessions generating more than 10 forbidden requests per minute (trade-off: sophisticated attackers can rotate sessions). (3) Disable self-registration or require admin approval for new user accounts to reduce attacker-controlled low-privilege credentials (trade-off: impacts legitimate user onboarding). These mitigations reduce but do not eliminate risk; patching is mandatory.