The vulnerability in Vvveb prior to version 1.0.8.3 involves uncontrolled recursion within the admin controller's dispatch cycle. Specifically, the Base::init() method repeatedly invokes the permission() function on error handlers when an error occurs, resulting in infinite recursion. This behavior causes PHP memory exhaustion, which can be triggered by an attacker sending sustained requests to forbidden admin URLs using a low-privilege account. The impact is a denial of service condition affecting all PHP worker processes. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required beyond low privilege, no user interaction, low confidentiality and integrity impact, high availability impact, and no scope or security requirement changes.

Successful exploitation leads to denial of service by exhausting PHP memory resources on all worker processes, disrupting legitimate traffic. The vulnerability can be triggered remotely over the network by a low-privilege attacker without user interaction. Confidentiality and integrity impacts are low, but availability is highly impacted due to service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to admin URLs to trusted users only and implement rate limiting or other controls to prevent sustained requests from low-privilege accounts targeting forbidden admin URLs.