CVE-2026-126323
Deferred Deferred - Pending Action

Cross-Site Request Forgery in Vvveb Admin Panel

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
Vvveb through 1.0.8.6 contains a cross-site request forgery vulnerability that allows attackers to perform admin state-changing actions because checkCsrf() in admin/controller/base.php only validates tokens for POST requests. Attackers can lure a logged-in admin into loading a forged cross-site GET request to delete admin/user accounts, sites, orders, and menus or change comment status.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126323
EUVD
EUVD-2026-125197

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
givanz Vvveb From 0 (inc) to 1.0.8.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a cross-site request forgery (CSRF) in Vvveb version 1.0.8.6 or earlier. The issue occurs because the checkCsrf() function in admin/controller/base.php only validates tokens for POST requests. Attackers can exploit this by tricking a logged-in admin into loading a malicious GET request, which can perform admin actions like deleting accounts, sites, orders, menus, or changing comment status without proper validation.

Detection Guidance

Detecting this CSRF vulnerability requires checking if Vvveb admin actions can be triggered via GET requests without proper CSRF token validation. Inspect server logs for suspicious GET requests to admin endpoints like /admin/controller/base.php performing actions such as account deletions or status changes. Review network traffic for repeated admin session activity from unexpected sources.

Impact Analysis

If you are an administrator using Vvveb, attackers could exploit this to delete your user accounts, sites, orders, or menus. They could also change comment statuses, potentially disrupting your website's functionality or causing data loss. Regular users might be affected if their accounts are deleted or if malicious changes are made to the site.

Compliance Impact

This vulnerability could lead to unauthorized modifications or deletions of sensitive data, which may violate compliance requirements under GDPR (data protection) or HIPAA (health information privacy). Unauthorized changes to user accounts or data could result in non-compliance, potential fines, or legal consequences depending on the data involved.

Mitigation Strategies

Upgrade Vvveb to the latest version beyond 1.0.8.6 where the CSRF token validation issue is fixed. Implement strict CSRF token checks for all admin actions, including GET requests. Disable admin actions via GET requests entirely and enforce POST-only operations. Monitor admin accounts for unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126323. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...