CVE-2026-46407 is an authorization bypass vulnerability in givanz Vvveb CMS before version 1.0.8.3. The issue arises because the admin/auth-token endpoint does not properly restrict access to API tokens, allowing an authenticated administrator to supply another administrator's admin_id and retrieve that user's REST API token list. This leads to unauthorized disclosure of sensitive API tokens. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key) and has a CVSS 3.1 score of 8.1, indicating high severity. The vendor has fixed this issue in version 1.0.8.3.

An authenticated administrator can access REST API tokens belonging to other administrators, potentially allowing unauthorized actions or access to sensitive administrative functions via those tokens. This compromises confidentiality and integrity of administrative credentials but does not affect availability. No known exploits in the wild have been reported.

Upgrade to givanz Vvveb version 1.0.8.3 or later, where this vulnerability is fixed. Since the vendor has released a fixed version, applying this official update is the recommended remediation. Patch status is confirmed by the vendor's versioning information.