CVE-2026-41931 is an information disclosure vulnerability in givanz Vvveb before version 1.0.8.2. The flaw exists in the password-reset module where unauthenticated attackers can trigger unhandled exceptions by accessing the admin password-reset endpoint. The root cause is a missing namespace import that leads to a fatal error. This error causes the debug exception handler to reveal sensitive server details such as absolute file paths, internal namespaces, line numbers, and source code snippets to unauthenticated users. This exposure can aid attackers in further reconnaissance or exploitation attempts. The vulnerability is classified under CWE-1188 (Improper Access of Indexable Resource) and CWE-209 (Information Exposure Through an Error Message).

The vulnerability allows unauthenticated attackers to obtain sensitive internal server information, including file paths and source code excerpts, which can facilitate further attacks or reconnaissance. However, it does not directly allow system compromise or privilege escalation. The CVSS 4.0 score of 6.9 reflects a medium severity impact due to information disclosure without direct integrity or availability impact. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the admin password-reset endpoint if possible and disable debug exception handlers in production environments to prevent sensitive information leakage. Monitor vendor channels for updates regarding an official patch or mitigation.