CVE-2026-41928 is an information disclosure vulnerability in the cron controller of givanz Vvveb prior to version 1.0.8.2. The flaw allows unauthenticated attackers to access the cron controller endpoint and obtain the secret cron key from the response. Possession of this key enables attackers to execute scheduled tasks arbitrarily, potentially disrupting intended application operations. The vulnerability is remotely exploitable without any privileges or user interaction.

An attacker can retrieve the secret cron key without authentication, allowing them to trigger scheduled tasks at will. This could lead to unauthorized execution of application functions tied to the cron jobs, potentially impacting application integrity or availability. There is no indication of direct data modification or privilege escalation beyond the cron task execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the cron controller endpoint through network controls or authentication mechanisms if possible to prevent unauthorized access to the secret key.