CVE-2026-46407

Executive Summary

CVE-2026-46407 is an information disclosure vulnerability in Vvveb CMS, a PHP-based content management system with a page builder. The flaw resides in the backend admin/auth-token endpoint, which fails to properly authorize token retrieval requests. An authenticated administrator can supply another administrator's admin_id to load that user's REST API token list, leading to the disclosure of sensitive API tokens. This could allow an attacker with administrative access to escalate privileges or perform lateral movement within the CMS by impersonating other administrators.

The vulnerability has a CVSS score of 8.1 (High), indicating significant confidentiality and integrity impact. No public proof-of-concept (PoC) or exploit code has been identified at this time. The vendor has released a fix in version 1.0.8.3.

Supply Chain & Package Security

Vvveb CMS is distributed as a PHP application, typically installed via direct download or Composer. The vulnerability affects the core application code, not a third-party package. Administrators should ensure they are using the latest patched version (1.0.8.3) and verify the integrity of their installation.

CVSS Breakdown & Threat Level

• CVSS Score: 8.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: High (PR:H) – requires authenticated administrator session
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H) – disclosure of API tokens
• Integrity Impact: High (I:H) – tokens can be used to perform actions as other admins
• Availability Impact: None (A:N)

Threat Level: High. While exploitation requires an authenticated administrator account, the impact is severe as it can lead to full compromise of other administrative accounts and their associated API tokens.

Deep Dive & Mechanics

The vulnerability exists in the admin/auth-token endpoint of Vvveb CMS. This endpoint is designed to allow administrators to view their own REST API tokens. However, the implementation fails to enforce proper authorization checks when an admin_id parameter is supplied.

Root Cause: The endpoint does not verify that the requesting administrator is the owner of the admin_id being queried. Instead, it directly uses the provided admin_id to fetch tokens from the database without checking if the current user has permission to view those tokens.

Attack Flow:

1. An attacker gains access to an administrator account (e.g., via credential theft, session hijacking, or insider threat).
2. The attacker sends a request to /admin/auth-token?admin_id=<target_admin_id>.
3. The server returns the API tokens belonging to the target administrator.
4. The attacker can then use these tokens to perform actions as the target administrator, potentially bypassing other security controls.

Impact: This vulnerability can lead to:

• Unauthorized access to sensitive API tokens.
• Privilege escalation within the CMS.
• Lateral movement to other administrative accounts.
• Potential data exfiltration or modification via API calls.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.0.8.3):

// In admin/auth-token endpoint
$admin_id = $_GET['admin_id'] ?? $_SESSION['admin_id'];
$tokens = getTokensByAdminId($admin_id);
echo json_encode($tokens);

Patched Code (1.0.8.3):

// In admin/auth-token endpoint
$admin_id = $_SESSION['admin_id']; // Only allow current user's tokens
$tokens = getTokensByAdminId($admin_id);
echo json_encode($tokens);

The patch removes the ability to supply an arbitrary admin_id via the request, ensuring that only the currently authenticated administrator's tokens are returned.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an administrator account on a vulnerable Vvveb CMS instance (version < 1.0.8.3).
• Knowledge of another administrator's user ID (can be enumerated via other endpoints or brute-forced).

Exploitation Steps:

1. Log in as an administrator.
2. Identify the target administrator's ID (e.g., admin_id=2).
3. Send a GET request to the vulnerable endpoint:

   GET /admin/auth-token?admin_id=2 HTTP/1.1
   Host: target-vvveb-instance.com
   Cookie: PHPSESSID=<your_session_cookie>
   

4. The response will contain the API tokens for the target administrator.
5. Use the stolen tokens to authenticate as the target administrator via the REST API.

Example cURL Command:

curl -X GET "http://target-vvveb-instance.com/admin/auth-token?admin_id=2" \
  -H "Cookie: PHPSESSID=your_session_id"

Blue Team

Detection:

• Monitor for unusual access to /admin/auth-token with varying admin_id parameters.
• Alert on multiple requests to this endpoint from the same session with different admin_id values.
• Review logs for administrative actions performed via API tokens that do not match the expected user behavior.

Hunting:

• Search for log entries containing admin/auth-token with admin_id parameter.
• Correlate API token usage with the original session that retrieved the tokens.
• Check for any API calls made with tokens that were not generated by the legitimate user.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /admin/auth-token with admin_id parameter.
  • Unusual API calls using tokens that were not generated by the expected user.
• Logs:
  • Multiple admin_id values in requests from the same session.
  • API token usage from IP addresses not associated with the legitimate administrator.
• System:
  • Presence of unauthorized API tokens in application logs or database dumps.

Detection Engineering

YARA Rule

rule CVE_2026_46407_Vvveb_Token_Disclosure {
    meta:
        description = "Detects exploitation attempts of CVE-2026-46407 in Vvveb CMS"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-46407"
    strings:
        $s1 = "/admin/auth-token" ascii wide nocase
        $s2 = "admin_id=" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2026-46407 Vvveb CMS API Token Disclosure
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2026-46407 by accessing other administrators' API tokens
author: Valters IT
date: 2026/01/01
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/admin/auth-token'
        cs-uri-query|contains: 'admin_id='
    condition: selection
falsepositives:
    - Legitimate administrative actions (should be rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-46407 Vvveb CMS API Token Disclosure Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/admin/auth-token"; http_uri; content:"admin_id="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Vvveb CMS to version 1.0.8.3 or later.
2. Review and rotate all existing API tokens for all administrators.
3. Audit logs for any signs of exploitation (unusual token usage, multiple admin_id requests).

Long-term Mitigations:

• Implement strict authorization checks on all endpoints that access user-specific data.
• Use role-based access control (RBAC) to ensure administrators can only view their own tokens.
• Enable logging and monitoring for all administrative actions.
• Conduct regular security reviews of custom code and third-party components.

Workarounds (if patching is not immediately possible):

• Implement a web application firewall (WAF) rule to block requests to /admin/auth-token with an admin_id parameter.
• Restrict access to the admin panel via IP whitelisting or VPN.
• Disable the REST API token feature temporarily if not required.

Valters IT
Securing Digital Frontiers