VVVEB · CVE-2026-126323 · Other
NO FIX YET
Vvveb is a content management system whose admin CSRF check only validates tokens on POST requests, so GET requests are not protected. A lured logged-in admin who opens a malicious page can have accounts, sites, orders, menus or comment status changed or deleted.
first public Oct 29, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running Vvveb through 1.0.8.6 where administrators are logged in while browsing other sites. The risk depends on an admin being tricked into loading a forged request, so exposure is greatest for admin accounts used for day-to-day browsing.
Not affected if newer-version, no-admin-login-while-browsing
Who cares cms, self-hosted, vvveb
1.0.8.6 and earlier are affected.admin/controller/base.php for the checkCsrf() function and whether it validates tokens for GET requests as well as POST.No fix yet, per the sources.
Vvveb through 1.0.8.6 contains a cross-site request forgery vulnerability that allows attackers to perform admin state-changing actions because checkCsrf() in admin/controller/base.php only validates tokens for POST requests. Attackers can lure a logged-in admin into loading a forged cross-site GET request to delete admin/user accounts, sites, orders, and menus or change comment status.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.