CVE-2026-34427

Vvveb versions prior to 1.0.8.1 are affected by a privilege escalation vulnerability in the admin user profile save endpoint that permits authenticated users to elevate their account privileges to Super Administrator level by injecting role_id=1 parameters into profile modification requests. This flaw enables attackers to bypass access controls and gain unauthorized administrative capabilities, including the ability to upload plugins and execute arbitrary code on affected systems. The vulnerability carries a CVSS score of 8.8 (HIGH) with a network-based attack vector requiring only low complexity and low privileges, meaning any authenticated user can exploit it without user interaction. The attack results in high confidentiality, integrity, and availability impacts across the affected system, posing significant risk to organizational security. Exploitation status indicates this vulnerability is not currently listed on the Known Exploited Vulnerabilities Catalog and is not on the active hot list, suggesting limited real-world exploitation to date. However, the relatively straightforward attack mechanism and severe impact warrant immediate patching, as the low EPSS score reflects its current lack of widespread weaponization rather than the severity of successful exploitation.