Which versions of Vvveb are affected by EUVD-2026-27885?

Vvveb versions prior to 1.0.8.2 contain hard-coded credentials in Docker configurations that expose phpMyAdmin and the entire application database to unauthenticated remote access.. A patch is available.

How to fix or mitigate EUVD-2026-27885?

Within 24 hours: Identify all Vvveb instances and verify current version (check docker-compose-apache.yaml and application version information); immediately isolate any instance running versions prior to 1.0.8.2 from internet-facing access. Within 7 days: Deploy Vvveb version 1.0.8.2 or later across all affected systems; regenerate all phpMyAdmin credentials and database user passwords; conduct database access logs review for unauthorized activity. Within 30 days: Perform full database integrity audit; reset all administrator and customer account credentials; implement network segmentation to restrict database access to authorized applications only.

Vvveb EUVD-2026-27885

Q: What is the CVSS score of EUVD-2026-27885?

EUVD-2026-27885 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-41930 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-05-06 VulnCheck

Authentication Bypass Docker Apache

9.2

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 06, 2026 - 19:46 vuln.today

Analysis Generated

May 06, 2026 - 19:46 vuln.today

CVSS changed

May 06, 2026 - 19:22 NVD

9.8 (CRITICAL) 9.2 (CRITICAL)

CVE Published

May 06, 2026 - 18:37 nvd

CRITICAL 9.2

DescriptionCVE.org

Vvveb before version 1.0.8.2 contains a hard-coded credentials vulnerability in its docker-compose-apache.yaml configuration that allows unauthenticated attackers to access the bundled phpMyAdmin container with pre-configured database credentials. Attackers can connect to the phpMyAdmin port to gain unrestricted read and write access to the entire Vvveb database, including administrator password hashes, customer personally identifiable information, and order data, enabling account takeover and data manipulation.

AnalysisAI

Hard-coded credentials in Vvveb's Docker deployment expose the entire application database to unauthenticated remote attackers. Versions prior to 1.0.8.2 ship with pre-configured phpMyAdmin credentials in docker-compose-apache.yaml, allowing direct database access without authentication. Attackers gain unrestricted read/write access to administrator password hashes, customer PII, and order data, enabling account takeover and data manipulation. CVSS 9.2 (Critical) reflects network-accessible attack with low complexity. Patch available in version 1.0.8.2 with vendor advisory confirmed by GitHub Security Advisory GHSA-g38h-mr9p-fjmf.

Technical ContextAI

This vulnerability stems from insecure defaults in Infrastructure-as-Code configurations. The docker-compose-apache.yaml file contains plaintext database credentials accessible to the phpMyAdmin container, mapping CWE-306 (Missing Authentication for Critical Function). Docker Compose configurations define container orchestration including environment variables, port mappings, and service credentials. When phpMyAdmin is exposed with hard-coded credentials, it bypasses the application's authentication layer entirely, granting direct MySQL/MariaDB access. The CPE cpe:2.3:a:givanz:vvveb identifies this as affecting the Givanz Vvveb content management system. CVSS 4.0 vector shows Attack Complexity Low (AC:L) with Present attack requirements (AT:P), indicating the phpMyAdmin port must be network-accessible, which is the case in default Docker deployments exposing container services.

RemediationAI

Upgrade immediately to Vvveb version 1.0.8.2 or later, available at https://github.com/givanz/Vvveb/releases/tag/1.0.8.2. The security fix is implemented in commit f85ca7c2bc389bda3cc2eca87b2514581a628c32 which removes hard-coded credentials from docker-compose-apache.yaml. For organizations unable to upgrade immediately, implement these specific compensating controls: (1) Block external access to phpMyAdmin container port (typically 8080 or 8081) using firewall rules-restricts attack to internal network only but does not eliminate risk from insider threats or lateral movement; (2) Change the default database credentials in docker-compose-apache.yaml and restart containers-requires manual configuration management and may break on updates; (3) Remove phpMyAdmin container entirely from docker-compose configuration if database administration can be performed through alternative tools-eliminates attack surface but reduces operational convenience. All workarounds are inferior to patching. After remediation, audit database access logs for suspicious queries and reset all administrator passwords as a precautionary measure given potential prior compromise.