What is the CVSS score of CVE-2026-46407?

CVE-2026-46407 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Vvveb CMS are affected by CVE-2026-46407?

Vvveb CMS versions before 1.0.8.3 contain an authorization bypass that allows authenticated administrators to retrieve API tokens of other administrators, enabling lateral privilege escalation across…. A patch is available.

How to fix or mitigate CVE-2026-46407?

Within 24 hours: Inventory all Vvveb CMS deployments and confirm versions below 1.0.8.3. Within 7 days: Upgrade all affected instances to Vvveb CMS version 1.0.8.3 or later; if immediate patching is impossible, revoke and regenerate all admin API tokens as interim mitigation. Within 30 days: Conduct access logs review for the past 90 days to detect unauthorized token access patterns; implement network segmentation to restrict admin REST API access by IP whitelist.

Vvveb CMS CVE-2026-46407

EUVD-2026-30585 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-05-15 GitHub_M

Authentication Bypass Vvveb

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

May 15, 2026 - 20:02 EUVD

Analysis Generated

May 15, 2026 - 19:32 vuln.today

DescriptionGitHub Advisory

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, the backend admin/auth-token endpoint allows an authenticated administrator to load another administrator's REST API token list by supplying that user's admin_id. This can disclose sensitive API tokens belonging to other administrators. This vulnerability is fixed in 1.0.8.3.

AnalysisAI

Authenticated administrators in Vvveb CMS versions before 1.0.8.3 can access REST API tokens of other administrators through the admin/auth-token endpoint by manipulating the admin_id parameter. This authorization bypass allows lateral privilege escalation between admin accounts, potentially compromising all administrative API operations. The vulnerability requires low-privileged authenticated access and has been patched in version 1.0.8.3.

Technical ContextAI

Vvveb is a content management system with page builder capabilities for creating websites and ecommerce stores. The vulnerability resides in the backend admin/auth-token endpoint which fails to properly validate authorization when retrieving API token lists. The flaw is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), where an authenticated user can manipulate the admin_id parameter to access resources belonging to other users. The affected CPE identifier is cpe:2.3:a:givanz:vvveb:*:*:*:*:*:*:*:*, indicating all versions prior to the fixed release are vulnerable.

RemediationAI

Vendor-released patch: upgrade to Vvveb CMS version 1.0.8.3 or later, which contains the fix for this authorization bypass. The patch is available through the project's GitHub repository as referenced in advisory GHSA-5g3g-x6mf-pwr6. As an interim mitigation, restrict administrative access to trusted users only and monitor admin/auth-token endpoint access logs for suspicious cross-admin token retrieval attempts. Consider implementing additional authentication factors for administrative accounts to reduce risk from compromised low-privilege admin credentials.