{"id":"CVE-2026-34427","title":"Vvveb < 1.0.8.1 Privilege Escalation via admin/user/save","summary":"Vvveb prior to 1.0.8.1 contains a privilege escalation vulnerability in the admin user profile save endpoint that allows authenticated users to modify privileged fields on their own profile. Attackers can inject role_id=1 into profile sa…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-915"],"vendor":"givanz","product":"Vvveb","affected":["Vvveb < 1.0.8.1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-04-20T14:50:56.641018Z"},"published":"2026-04-20","updated":"2026-11-08","sourceUpdated":"2026-11-08T14:02:07.688Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-34427","references":[{"url":"https://github.com/givanz/Vvveb/releases/tag/1.0.8.1","label":"Vvveb 1.0.8.1 Release Notes"},{"url":"https://github.com/givanz/Vvveb/commit/0eca14af50f038915b8bf7ceec2becf6b6720b0a"},{"url":"https://www.vulncheck.com/advisories/vvveb-privilege-escalation-via-admin-user-save"}],"tags":["cve.org"],"epss":0.00562,"epssPercentile":0.47015,"ingestedAt":"2026-11-08T14:51:22.457Z","slug":"CVE-2026-34427","body":"## Overview\n\nVvveb prior to 1.0.8.1 contains a privilege escalation vulnerability in the admin user profile save endpoint that allows authenticated users to modify privileged fields on their own profile. Attackers can inject role_id=1 into profile save requests to escalate to Super Administrator privileges, enabling plugin upload functionality for remote code execution.\n\n## Affected\n\n- `Vvveb < 1.0.8.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":49,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}