CVE-2026-29789

Summary: Vito (self-hosted web app) suffers a cross-project privilege escalation due to a missing authorization check in workflow site-creation actions. Affected versions: prior to 3.20.3. Impact: an authenticated user with workflow write access in one project can create/manage sites on servers b...

vito 安全漏洞

VitoDeploy is an open-source web application for server management and PHP application deployment. Versions of Vito before 3.20.3 contained security vulnerabilities. These vulnerabilities stemmed from the lack of authorization checks during the workflow site creation process. This could allow a...

CVE-2026-29789: Missing Authorization

Vito is a self-hosted web application that helps manage servers and deploy PHP applications into production servers. Prior to version 3.20.3, a missing authorization check in workflow site-creation actions allows an authenticated attacker with workflow write access in one project to create/manage...