---
id: "CVE-2026-110799"
kind: "vulnerability"
aliases: ["CVE-2026-110799"]
title: "Vvveb CMS: password reset flaw lets attackers bypass login"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cms", "package", "php", "self-hosted", "vvveb"]
not_affected_if: ["version-1.0.8.7-or-later"]
published_at: "2026-10-30T15:16:44+00:00"
first_seen_at: "2026-10-30T15:31:09+00:00"
updated_at: "2026-10-30T15:33:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110799", "first_seen_at": "2026-10-30T15:31:09+00:00"}]
---

# Vvveb CMS: password reset flaw lets attackers bypass login

Vvveb is a content management system for building websites, blogs and stores. Before version 1.0.8.7, weak checks on the user and token parameters of its password reset flow let an attacker bypass authentication.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Vvveb version and see whether it is below `1.0.8.7`.
- Review the deployment's package or source to confirm which Vvveb release is running.

## Fix

- Upgrade Vvveb to `1.0.8.7` or later.

## Timeline

- 2026-10-30T15:31:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110799

## From the sources

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, the password reset functionality is vulnerable to an Authentication Bypass due to insufficient validation of the user and token GET parameters. This issue has been patched in version 1.0.8.7.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_