CVE-2026-29789
📋 TL;DR
This vulnerability allows authenticated attackers with workflow write access in one project to create and manage sites on servers belonging to other projects by exploiting a missing authorization check. It affects Vito deployments prior to version 3.20.3 where users have workflow write permissions. Attackers can perform unauthorized server operations across project boundaries.
💻 Affected Systems
- Vito
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
An attacker could deploy malicious PHP applications across all servers, compromise sensitive data, disrupt production services, and establish persistent backdoors throughout the infrastructure.
Likely Case
Attackers with workflow access could deploy unauthorized applications, modify existing sites, or disrupt services on servers they shouldn't have access to, potentially leading to data exposure or service outages.
If Mitigated
With proper network segmentation and minimal privilege access, impact would be limited to unauthorized site creation within the same network segment, but cross-project isolation would still be violated.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once an attacker has workflow write permissions. The vulnerability is in authorization logic, not authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.20.3
Vendor Advisory: https://github.com/vitodeploy/vito/security/advisories/GHSA-3m6w-8qh4-qr76
Restart Required: Yes
Instructions:
1. Backup your Vito configuration and database. 2. Update Vito to version 3.20.3 using your deployment method (Docker, package manager, or source). 3. Restart the Vito service. 4. Verify the update by checking the version in the web interface or via API.
🔧 Temporary Workarounds
Restrict Workflow Write Access
allTemporarily remove workflow write permissions from all users except absolutely necessary administrators.
# Review and modify user permissions in Vito admin interface
# No specific CLI command - use web interface
Network Segmentation
linuxIsolate Vito instances and backend servers to prevent cross-project server access even if authorization is bypassed.
# Configure firewall rules to restrict Vito-server communications
# Example: iptables -A OUTPUT -d [server_ip] -j DROP for unauthorized servers
🧯 If You Can't Patch
- Implement strict network segmentation between projects to prevent Vito from accessing servers outside authorized project boundaries.
- Enable detailed audit logging for all site creation and management actions and monitor for unauthorized cross-project operations.
🔍 How to Verify
Check if Vulnerable:
Check Vito version via web interface dashboard or API endpoint /api/version. If version is below 3.20.3, the system is vulnerable.Check Version:
curl -s http://vito-host/api/version | grep versionVerify Fix Applied:
After updating, verify version is 3.20.3 or higher. Test that users with workflow write access in one project cannot create sites on servers belonging to other projects.📡 Detection & Monitoring
Log Indicators:
- Unauthorized server_id parameter in site creation requests
- Site creation attempts with server_ids from different projects
- Failed authorization checks in workflow actions
Network Indicators:
- Vito instance communicating with servers outside expected project ranges
- Unusual site deployment patterns across multiple projects
SIEM Query:
source="vito.logs" AND (event="site_create" OR event="site_manage") AND server_id NOT IN authorized_servers