Question 1

What is this vulnerability? (Essence + Consequences)

Accepted Answer

🚨 **Essence**: Missing Authorization Check in Workflow Site Creation.
💥 **Consequences**: Attackers can create/manage sites on servers belonging to *other* projects. Total loss of isolation between projects.

Question 2

Root Cause? (CWE/Flaw)

Accepted Answer

🛡️ **Root Cause**: CWE-862 (Missing Authorization).
🔍 **Flaw**: The system fails to verify if the user owns the target `server_id` when creating a site via workflow. It trusts the input blindly.

Question 3

Who is affected? (Versions/Components)

Accepted Answer

📦 **Affected**: Vito (VitoDeploy).
📉 **Versions**: All versions **before 3.20.3**.
🔧 **Component**: Server management & PHP app deployment web interface.

Question 4

What can hackers do? (Privileges/Data)

Accepted Answer

👮 **Privileges**: Escalates from 'Project Workflow Writer' to 'Cross-Project Server Admin'.
📂 **Data**: Can deploy code, modify configs, and potentially access data on servers not owned by the attacker's project.

Question 5

Is exploitation threshold high? (Auth/Config)

Accepted Answer

⚠️ **Threshold**: Medium.
🔑 **Auth**: Requires **Valid Login** (PR:L).
🎯 **Config**: Needs 'Write' permission on a workflow in *any* project. No UI interaction needed (UI:N).

Question 6

Is there a public Exp? (PoC/Wild Exploitation)

Accepted Answer

🚫 **Public Exp**: No PoC provided in data.
🌐 **Wild Exp**: Low risk currently.
📝 **Note**: CVSS S:C (Changed Scope) implies high impact, but exploitation requires specific internal knowledge of server IDs.

Question 7

How to self-check? (Features/Scanning)

Accepted Answer

🔍 **Self-Check**:
1. Check Vito version.
2. Audit users with 'Workflow Write' access.
3. Monitor logs for site creation requests with `server_id` not matching the project's servers.

Question 8

Is it fixed officially? (Patch/Mitigation)

Accepted Answer

✅ **Fixed**: Yes!
📅 **Patch**: Version **3.20.3**.
🔗 **Source**: GitHub Release & Security Advisory (GHSA-3m6w-8qh4-qr76).

Question 9

What if no patch? (Workaround)

Accepted Answer

🛡️ **Workaround**:
1. **Upgrade** to v3.20.3+ immediately.
2. If stuck: Restrict 'Workflow Write' permissions to admins only.
3. Implement WAF rules to validate `server_id` against project ownership.

Question 10

Is it urgent? (Priority Suggestion)

Accepted Answer

🔥 **Urgency**: HIGH.
📊 **Priority**: P1.
💡 **Why**: CVSS 9.1 (Critical). Scope Change (S:C) means one breach affects multiple projects. Patch immediately to prevent lateral movement.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-29789 — AI Deep Analysis Summary

Q1What is this vulnerability? (Essence + Consequences)

Q2Root Cause? (CWE/Flaw)

Q3Who is affected? (Versions/Components)

Q4What can hackers do? (Privileges/Data)

Q5Is exploitation threshold high? (Auth/Config)

Q6Is there a public Exp? (PoC/Wild Exploitation)

Q7How to self-check? (Features/Scanning)

Q8Is it fixed officially? (Patch/Mitigation)

Q9What if no patch? (Workaround)

Q10Is it urgent? (Priority Suggestion)

Continue exploring