{"affected":[{"product":"Vvveb","source":"CNA: GitHub_M","vendor":"givanz","versions":[{"status":"affected","version":"< 1.0.8.7"}]}],"cveId":"CVE-2026-112905","cwes":["CWE-285"],"description":"Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, authenticated IDOR on admin/auth-token endpoint allows any administrator to read and overwrite another administrator's API tokens. This issue has been patched in version 1.0.8.7.","epss":{"date":"2026-11-04","percentile":0.42596,"score":0.00495},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/givanz/Vvveb/security/advisories/GHSA-hg48-r64v-9rvq"}],"kev":null,"metrics":[{"score":9,"severity":"critical","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L","version":"3.1"},{"score":9,"severity":"critical","source":"NVD: security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L","version":"3.1"}],"modifiedAt":1793834238640,"publishedAt":1793369986201,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/givanz/Vvveb/security/advisories/GHSA-hg48-r64v-9rvq"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/givanz/Vvveb/security/advisories/GHSA-hg48-r64v-9rvq"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/givanz/Vvveb/security/advisories/GHSA-hg48-r64v-9rvq"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":[],"url":"https://github.com/givanz/Vvveb/security/advisories/GHSA-hg48-r64v-9rvq"}],"remediation":[],"revision":"3cc28961873b0035cbac9f1ebe691510261e37e296b8eee4cd4bffc7ca4cb802","sources":[{"modifiedAt":1793831815917,"name":"CNA: GitHub_M","retrievedAt":1793833718013,"url":"https://www.cve.org/CVERecord?id=CVE-2026-112905"},{"modifiedAt":1793834238640,"name":"NVD","retrievedAt":1793838188004,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112905"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793833727933,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112905"}],"ssvc":{"assessedAt":1793831786161,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Vvveb: Authenticated IDOR on admin/auth-token Allows Admin Privilege Escalation via API Token Theft","updatedAt":1793838188004}