CVE-2026-41928 is an information disclosure vulnerability affecting Vvveb before version 1.0.8.2. The flaw exists in the cron controller, which improperly exposes the secret cron key to unauthenticated users. This exposure allows attackers to retrieve the secret key from the controller's response and subsequently trigger scheduled tasks at unauthorized times. The vulnerability has a CVSS 4.0 score of 6.9, reflecting a medium severity level with network attack vector, no privileges required, and no user interaction needed. No vendor advisory or patch information is currently available, and the product is not cloud-hosted.

An attacker can retrieve the secret cron key without authentication, enabling them to execute scheduled tasks outside of their intended schedule. This could lead to unauthorized task execution, potentially impacting application behavior or stability. There are no reports of exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the cron controller endpoint if possible and monitor for unusual task execution patterns. Avoid exposing the cron controller to untrusted networks.