{"id":"CVE-2026-110799","kind":"vulnerability","aliases":["CVE-2026-110799"],"related":[],"title":"Vvveb CMS: password reset flaw lets attackers bypass login","description":"Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, the password reset functionality is vulnerable to an Authentication Bypass due to insufficient validation of the user and token GET parameters. This issue has been patched in version 1.0.8.7.","summary":"Vvveb is a content management system for building websites, blogs and stores. Before version 1.0.8.7, weak checks on the user and token parameters of its password reset flow let an attacker bypass authentication.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cms","package","php","self-hosted","vvveb"],"not_affected_if":["version-1.0.8.7-or-later"],"how_to_check":"- Check the installed Vvveb version and see whether it is below `1.0.8.7`.\n- Review the deployment's package or source to confirm which Vvveb release is running.","fix":"- Upgrade Vvveb to `1.0.8.7` or later.","status":"open","published_at":"2026-10-30T15:16:44+00:00","first_seen_at":"2026-10-30T15:31:09+00:00","triaged_at":"2026-10-30T15:33:03+00:00","updated_at":"2026-10-30T15:33:04+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T15:33:03Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Vvveb to `1.0.8.7` or later.","reach":"internet","title":"Vvveb CMS: password reset flaw lets attackers bypass login","impact":"high","summary":"Vvveb is a content management system for building websites, blogs and stores. Before version 1.0.8.7, weak checks on the user and token parameters of its password reset flow let an attacker bypass authentication.","audience":"businesses","category":"package","nicknames":[],"who_cares":["vvveb","cms","self-hosted","php"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"attacker gains access to user accounts without credentials","analyst_note":"Confirm from the NVD entry or the Vvveb release notes whether exploitation needs the password reset feature enabled, and whether any admin account is reachable.","how_to_check":"- Check the installed Vvveb version and see whether it is below `1.0.8.7`.\n- Review the deployment's package or source to confirm which Vvveb release is running.","plain_action":"","needs_analyst":true,"not_affected_if":["version-1.0.8.7-or-later"],"who_is_affected":"Any site running Vvveb before 1.0.8.7 with the password reset feature reachable is exposed, since the flaw sits in the reset flow's parameter validation. Sites that do not run Vvveb, or run 1.0.8.7 or later, are not affected. Whether the reset feature must be enabled or reachable from the internet is unknown from the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000694,"input_tokens":4139,"output_tokens":561,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-110799':12A,15A '-2026':11A,14A '1.0.8.7':37B,78C,107C 'attack':7A,53B 'authent':55B,87C 'blog':32B,71C 'build':30B,69C 'builder':67C 'bypass':8A,54B,88C 'check':39B 'cms':2A,16B,64C 'content':26B 'cve':10A,13A 'due':89C 'easi':61C 'ecommerc':73C 'flaw':5A 'flow':50B 'function':82C 'get':98C 'host':21B 'insuffici':91C 'issu':101C 'let':6A,51B 'login':9A 'manag':27B 'packag':17B 'page':66C 'paramet':45B,99C 'password':3A,48B,80C 'patch':104C 'php':18B 'power':59C 'prior':75C 'reset':4A,49B,81C 'self':20B 'self-host':19B 'store':34B,74C 'system':28B 'token':44B,97C 'use':63C 'user':42B,95C 'valid':92C 'version':36B,77C,106C 'vulner':84C 'vvveb':1A,22B,23B,56C 'weak':38B 'websit':31B,70C","nicknames":[],"mitigations":[],"who_affected":"Any site running Vvveb before 1.0.8.7 with the password reset feature reachable is exposed, since the flaw sits in the reset flow's parameter validation. Sites that do not run Vvveb, or run 1.0.8.7 or later, are not affected. Whether the reset feature must be enabled or reachable from the internet is unknown from the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T15:16:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110799","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110799","severity":null,"published_at":"2026-10-30T15:16:44+00:00","modified_at":"2026-10-30T15:16:44+00:00","first_seen_at":"2026-10-30T15:31:09+00:00","fetched_at":"2026-10-30T15:31:09+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}