CVE-2026-55232: CWE-918: Server-Side Request Forgery (SSRF) in givanz Vvveb
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's SSRF guard resolves a host with an IPv4-only function and never inspects IPv6, so any host that lacks an A record passes a private-range check. Editor oEmbed proxy fetches an attacker-supplied URL server side and reflects a response body, so an authenticated admin-panel user (default role site_admin or higher) can read internal-only services and cloud metadata, including IAM credentials, using an IPv6 literal or a domain that carries only an AAAA record. This issue has been patched in version 1.0.8.6.
AI Analysis
Technical Summary
Vvveb CMS before version 1.0.8.6 has an SSRF vulnerability (CWE-918) because its SSRF protection only resolves hosts using an IPv4-only function, ignoring IPv6 addresses. Consequently, hosts without an A record but with an AAAA record bypass private-range checks. The editor's oEmbed proxy fetches attacker-supplied URLs server-side and reflects the response body. An authenticated admin user (site_admin role or higher) can exploit this to access internal services and cloud metadata, including IAM credentials. The vulnerability is fixed in version 1.0.8.6.
Potential Impact
An authenticated user with admin-panel access can exploit this SSRF vulnerability to read sensitive internal resources and cloud metadata, potentially exposing IAM credentials. This can lead to unauthorized access to internal services and compromise of cloud infrastructure credentials. The vulnerability does not allow unauthenticated exploitation and requires high privileges.
Mitigation Recommendations
Upgrade Vvveb CMS to version 1.0.8.6 or later, where the SSRF vulnerability has been patched. No additional mitigation is required once the update is applied.
CVE-2026-55232: CWE-918: Server-Side Request Forgery (SSRF) in givanz Vvveb
Description
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's SSRF guard resolves a host with an IPv4-only function and never inspects IPv6, so any host that lacks an A record passes a private-range check. Editor oEmbed proxy fetches an attacker-supplied URL server side and reflects a response body, so an authenticated admin-panel user (default role site_admin or higher) can read internal-only services and cloud metadata, including IAM credentials, using an IPv6 literal or a domain that carries only an AAAA record. This issue has been patched in version 1.0.8.6.
CVSS v3.1
Score 7.6high
Affected software
givanz
Vvveb
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Vvveb CMS before version 1.0.8.6 has an SSRF vulnerability (CWE-918) because its SSRF protection only resolves hosts using an IPv4-only function, ignoring IPv6 addresses. Consequently, hosts without an A record but with an AAAA record bypass private-range checks. The editor's oEmbed proxy fetches attacker-supplied URLs server-side and reflects the response body. An authenticated admin user (site_admin role or higher) can exploit this to access internal services and cloud metadata, including IAM credentials. The vulnerability is fixed in version 1.0.8.6.
Potential Impact
An authenticated user with admin-panel access can exploit this SSRF vulnerability to read sensitive internal resources and cloud metadata, potentially exposing IAM credentials. This can lead to unauthorized access to internal services and compromise of cloud infrastructure credentials. The vulnerability does not allow unauthenticated exploitation and requires high privileges.
Mitigation Recommendations
Upgrade Vvveb CMS to version 1.0.8.6 or later, where the SSRF vulnerability has been patched. No additional mitigation is required once the update is applied.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-16T16:44:00.623Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6abeae1ca43b0b3b89e80a2b
Added to database: 10/01/2026, 19:01:48 UTC
Last enriched: 10/01/2026, 19:16:02 UTC
Last updated: 10/02/2026, 03:06:36 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.