CVE-2026-46407 is an authorization bypass vulnerability in givanz Vvveb CMS before version 1.0.8.3. The backend admin/auth-token endpoint improperly allows an authenticated administrator to retrieve the REST API token list of other administrators by supplying their admin_id. This flaw exposes sensitive API tokens, potentially compromising administrator accounts. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key) and has a CVSS 3.1 base score of 8.1, indicating high impact on confidentiality and integrity. The issue is resolved in version 1.0.8.3.

An attacker with authenticated administrator privileges can obtain REST API tokens belonging to other administrators, leading to potential unauthorized access and misuse of administrative API functions. This compromises the confidentiality and integrity of administrator credentials and associated operations. There is no indication of availability impact or known exploits in the wild at this time.

Upgrade to givanz Vvveb version 1.0.8.3 or later, where this authorization bypass vulnerability is fixed. Since the vendor has released a fixed version, applying this official update is the recommended remediation. Patch status is confirmed by the vendor's versioning information. No additional mitigations are indicated.