{"id":"CVE-2026-126323","kind":"vulnerability","aliases":["CVE-2026-126323"],"related":[],"title":"Vvveb: cross-site GET requests let attackers change admin data","description":"Vvveb through 1.0.8.6 contains a cross-site request forgery vulnerability that allows attackers to perform admin state-changing actions because checkCsrf() in admin/controller/base.php only validates tokens for POST requests. Attackers can lure a logged-in admin into loading a forged cross-site GET request to delete admin/user accounts, sites, orders, and menus or change comment status.","summary":"Vvveb is a content management system whose admin CSRF check only validates tokens on POST requests, so GET requests are not protected. A lured logged-in admin who opens a malicious page can have accounts, sites, orders, menus or comment status changed or deleted.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Vvveb","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cms","other","self-hosted","vvveb"],"not_affected_if":["newer-version","no-admin-login-while-browsing"],"how_to_check":"- Check the installed Vvveb version against the range in the advisory: `1.0.8.6` and earlier are affected.\n- Look at `admin/controller/base.php` for the `checkCsrf()` function and whether it validates tokens for GET requests as well as POST.","fix":null,"status":"open","published_at":"2026-11-13T10:17:38+00:00","first_seen_at":"2026-11-13T10:47:16+00:00","triaged_at":"2026-11-13T10:57:23+00:00","updated_at":"2026-11-13T10:57:23+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-13T10:57:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Vvveb: cross-site GET requests let attackers change admin data","impact":"medium","summary":"Vvveb is a content management system whose admin CSRF check only validates tokens on POST requests, so GET requests are not protected. A lured logged-in admin who opens a malicious page can have accounts, sites, orders, menus or comment status changed or deleted.","audience":"businesses","category":"other","nicknames":[],"who_cares":["vvveb","self-hosted","cms"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Admin accounts, sites and orders get deleted or altered through lured requests.","analyst_note":"Confirm the fixed version and whether a patch exists in the GitHub advisory and VulnCheck page linked in the signal.","how_to_check":"- Check the installed Vvveb version against the range in the advisory: `1.0.8.6` and earlier are affected.\n- Look at `admin/controller/base.php` for the `checkCsrf()` function and whether it validates tokens for GET requests as well as POST.","plain_action":"","product_name":"Vvveb","needs_analyst":true,"not_affected_if":["no-admin-login-while-browsing","newer-version"],"who_is_affected":"Sites running Vvveb through 1.0.8.6 where administrators are logged in while browsing other sites. The risk depends on an admin being tricked into loading a forged request, so exposure is greatest for admin accounts used for day-to-day browsing.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000753,"input_tokens":4629,"output_tokens":581,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126323':14A,17A '-2026':13A,16A '1.0.8.6':72C 'account':60B,121C 'action':90C 'admin':10A,32B,52B,86C,108C 'admin/controller/base.php':94C 'admin/user':120C 'allow':82C 'attack':8A,83C,101C 'chang':9A,67B,89C,127C 'check':34B 'checkcsrf':92C 'cms':19B 'comment':65B,128C 'contain':73C 'content':28B 'cross':3A,76C,114C 'cross-sit':2A,75C,113C 'csrf':33B 'cve':12A,15A 'data':11A 'delet':69B,119C 'forg':112C 'forgeri':79C 'get':5A,42B,116C 'host':23B 'let':7A 'load':110C 'log':50B,106C 'logged-in':49B,105C 'lure':48B,103C 'malici':56B 'manag':29B 'menus':63B,125C 'open':54B 'order':62B,123C 'page':57B 'perform':85C 'post':39B,99C 'protect':46B 'request':6A,40B,43B,78C,100C,117C 'self':22B 'self-host':21B 'site':4A,61B,77C,115C,122C 'state':88C 'state-chang':87C 'status':66B,129C 'system':30B 'token':37B,97C 'valid':36B,96C 'vulner':80C 'vvveb':1A,18A,24B,25B,70C 'whose':31B","nicknames":[],"mitigations":[],"who_affected":"Sites running Vvveb through 1.0.8.6 where administrators are logged in while browsing other sites. The risk depends on an admin being tricked into loading a forged request, so exposure is greatest for admin accounts used for day-to-day browsing.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["vvveb"],"ptokens":["vvveb"],"labels":["cms","medium","other","selfhosted","vendor","vvveb"],"campaign_type":null,"search_a":"'-126323':14A,17A '-2026':13A,16A 'admin':10A 'attack':8A 'chang':9A 'cross':3A 'cross-sit':2A 'cve':12A,15A 'data':11A 'get':5A 'let':7A 'request':6A 'site':4A 'vvveb':1A,18A","search_b":"'account':60B 'admin':32B,52B 'chang':67B 'check':34B 'cms':19B 'comment':65B 'content':28B 'csrf':33B 'delet':69B 'get':42B 'host':23B 'log':50B 'logged-in':49B 'lure':48B 'malici':56B 'manag':29B 'menus':63B 'open':54B 'order':62B 'page':57B 'post':39B 'protect':46B 'request':40B,43B 'self':22B 'self-host':21B 'site':61B 'status':66B 'system':30B 'token':37B 'valid':36B 'vvveb':24B,25B 'whose':31B","search_c":"'1.0.8.6':72C 'account':121C 'action':90C 'admin':86C,108C 'admin/controller/base.php':94C 'admin/user':120C 'allow':82C 'attack':83C,101C 'chang':89C,127C 'checkcsrf':92C 'comment':128C 'contain':73C 'cross':76C,114C 'cross-sit':75C,113C 'delet':119C 'forg':112C 'forgeri':79C 'get':116C 'load':110C 'log':106C 'logged-in':105C 'lure':103C 'menus':125C 'order':123C 'perform':85C 'post':99C 'request':78C,100C,117C 'site':77C,115C,122C 'state':88C 'state-chang':87C 'status':129C 'token':97C 'valid':96C 'vulner':80C 'vvveb':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-29T01:14:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126323","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126323","severity":null,"published_at":"2026-11-13T10:17:38+00:00","modified_at":"2026-11-13T10:17:38+00:00","first_seen_at":"2026-11-13T10:47:16+00:00","fetched_at":"2026-11-13T10:47:16+00:00","note":null}],"documents":[{"id":144977,"url":"https://github.com/givanz/Vvveb/security/advisories/GHSA-grxp-rj92-j8xr","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-29T01:14:20+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144978,"url":"https://www.vulncheck.com/advisories/vvveb-through-1.0.8.6-csrf-via-get-admin-state-changing-actions","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}