Privilege Escalation in Vvveb Allows Unauthorized Access to Admin Features

CVE-2026-34427

What is CVE-2026-34427?

Prior versions of Vvveb (before 1.0.8.1) are susceptible to a privilege escalation flaw that enables authenticated users to alter sensitive fields within their own admin profiles. By injecting specific parameters, such as role_id=1, an attacker can gain Super Administrator privileges. This vulnerability not only permits unauthorized modification of user roles but also opens up potential pathways for remote code execution through enabling plugin upload functionality.

References