Vvveb Prior to 1.0.8.3 Vulnerable to DoS via Uncontrolled Recursion

The National Vulnerability Database reports a critical uncontrolled recursion vulnerability, CVE-2026-41935, affecting Vvveb versions prior to 1.0.8.3. This flaw resides in the admin controller dispatch cycle, where the Base::init() function repeatedly calls permission() on error handlers. This creates an infinite recursion loop, rapidly exhausting PHP memory limits.

Attackers can exploit this with minimal effort. By sending sustained requests to forbidden administrative URLs from a low-privilege account, they can trigger this recursion. The result is a complete denial of service (DoS) for all legitimate traffic, as all PHP workers become incapacitated. The National Vulnerability Database assigns this a CVSS score of 7.1 (High severity), emphasizing the significant impact on availability.

This isn’t just a crash; it’s a resource exhaustion attack that any authenticated, low-privilege user can execute. Defenders need to understand that this isn’t about data exfiltration, but about crippling operations. The attacker’s calculus is simple: maximum disruption with minimal access. Patches are the only solution here, as this is a fundamental architectural flaw in how error handling interacts with permissions.