CVE-2026-41935 affects Vvveb before version 1.0.8.3 and involves uncontrolled recursion within the admin controller dispatch cycle. Specifically, the Base::init() method repeatedly invokes the permission() function on error handlers when an error occurs, causing infinite recursion until PHP memory limits are reached. This can be triggered by an attacker with low privileges sending repeated requests to forbidden admin URLs, resulting in denial of service due to memory exhaustion. The vulnerability is remotely exploitable over the network without user interaction and has a high impact on availability.

Successful exploitation leads to denial of service by exhausting PHP memory on all worker processes, preventing legitimate traffic from being served. The vulnerability requires only low privileges and no user interaction, making it relatively easy to exploit remotely. There is no indication of data confidentiality or integrity impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting access to admin URLs and monitoring for unusual request patterns that could indicate exploitation attempts. Avoid exposing the admin interface to untrusted networks. No official patch or temporary fix has been published at this time.