CVE-2026-41930 Details

A hard-coded credentials vulnerability has been identified in Vvveb versions prior to 1.0.8.2. The issue resides in the docker-compose-apache.yaml file, where phpMyAdmin is configured with default credentials that allow unauthenticated access to the phpMyAdmin container. This misconfiguration enables attackers to connect to phpMyAdmin and gain unrestricted read and write access to the Vvveb database. Sensitive data at risk includes administrator password hashes, customer personally identifiable information, and order details, all of which could facilitate account takeovers and unauthorized data manipulation.

To address this vulnerability, Vvveb users should update to version 1.0.8.2 or later. After updating, remove any phpMyAdmin port mappings from the docker-compose file and run 'docker compose up -d' to apply the changes. If phpMyAdmin access is needed, it should be secured behind an authentication layer and only exposed on the internal Docker network.