CVE-2026-41935 describes an uncontrolled recursion vulnerability in Vvveb prior to version 1.0.8.3. The issue occurs in the admin controller dispatch cycle where the Base::init() method repeatedly invokes the permission() function on error handlers when an error occurs. This leads to infinite recursion until PHP memory limits are exhausted. An attacker with low privileges can exploit this by sending repeated requests to forbidden admin URLs, causing a denial of service by depleting server memory resources.

Successful exploitation results in denial of service due to exhaustion of PHP memory limits on all worker processes. This disrupts legitimate traffic and availability of the affected Vvveb service. The vulnerability requires no user interaction and can be triggered by a low-privilege attacker remotely.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict access to admin URLs and monitor for unusual request patterns to mitigate potential exploitation.