What is CVE-2026-34427?

CVE-2026-34427 is a high-severity vulnerability in Givanz Vvveb, classified under Improperly Controlled Modification of Dynamically-Determined Object Attributes. CVSS score: 8.8/10. Published 2026-04-20.

How severe is CVE-2026-34427?

High severity. CVSS v3 base score is 8.8 out of 10.

Vulnerability in Givanz Vvveb

CVE-2026-34427

Vvveb prior to 1.0.8.1 contains a privilege escalation vulnerability in the admin user profile save endpoint that allows authenticated users to modify privileged fields on their own profile. Attackers can inject role_id=1 into profile save…

Vulnerability class: Mass Assignment

EPSS: 0.004 (59.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Givanz Vvveb — versions 0, 0eca14af50f038915b8bf7ceec2becf6b6720b0a

Weakness classification (CWE)

CWE-915 — Improperly Controlled Modification of Dynamically-Determined Object Attributes

References

github.com/givanz/Vvveb/releases/tag/1.0.8.1 (release-notes)
github.com/givanz/Vvveb/commit/0eca14af50f038915b8bf7ceec2becf6b6720b0a (patch)
www.vulncheck.com/advisories/vvveb-privilege-escalation-via-admin-user-save (third-party-advisory)

Frequently asked questions

What is CVE-2026-34427?: CVE-2026-34427 is a high-severity vulnerability in Givanz Vvveb, classified under Improperly Controlled Modification of Dynamically-Determined Object Attributes. CVSS score: 8.8/10. Published 2026-04-20.
How severe is CVE-2026-34427?: High severity. CVSS v3 base score is 8.8 out of 10.