CVE-2026-29789 in vito
Summary
by MITRE • 03/06/2026
Vito is a self-hosted web application that helps manage servers and deploy PHP applications into production servers. Prior to version 3.20.3, a missing authorization check in workflow site-creation actions allows an authenticated attacker with workflow write access in one project to create/manage sites on servers belonging to other projects by supplying a foreign server_id. This issue has been patched in version 3.20.3.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 03/14/2026
The vulnerability identified as CVE-2026-29789 affects Vito, a self-hosted web application designed for server management and PHP application deployment in production environments. This application serves as a centralized platform for administrators to handle multiple server configurations and deployment workflows across different projects. The security flaw manifests in the application's authorization mechanisms, specifically within workflow site-creation actions that govern how new sites are established and managed within the system. The vulnerability represents a critical authorization bypass issue that undermines the fundamental security boundaries between different project environments.
The technical implementation flaw stems from a missing authorization check during workflow site-creation operations. When an authenticated attacker possesses write access to workflow actions within one project, they can exploit this weakness to create and manage sites on servers belonging to entirely different projects. The vulnerability is triggered when the attacker supplies a foreign server_id parameter that references resources outside their authorized project scope. This missing validation allows the system to process site creation requests without properly verifying whether the requesting user has legitimate access rights to the target server and project environment. The flaw essentially permits cross-project resource manipulation through the workflow system, creating unauthorized access pathways between isolated project boundaries.
The operational impact of this vulnerability is severe and multifaceted for organizations relying on Vito for server management and application deployment. An attacker with minimal privileges within one project can escalate their access to compromise resources in other projects, potentially leading to data exposure, service disruption, and unauthorized code deployment. The vulnerability undermines the principle of least privilege and project isolation that security-conscious organizations depend upon for maintaining separate development, staging, and production environments. This issue could enable attackers to gain access to sensitive application configurations, deployment credentials, and potentially compromise entire server infrastructures belonging to other projects within the same Vito instance.
The vulnerability aligns with CWE-862, which describes inadequate authorization checks that allow unauthorized access to resources. From an adversarial perspective, this flaw maps to ATT&CK technique T1078.004, which involves legitimate credentials use for lateral movement and privilege escalation. Organizations using Vito should prioritize immediate patching to version 3.20.3, which implements the necessary authorization checks to prevent cross-project site creation and management. Additional mitigations include implementing network segmentation between project environments, conducting regular access control reviews, and monitoring workflow actions for unauthorized cross-project resource access attempts. Security teams should also consider implementing automated detection mechanisms to identify potential exploitation attempts of this authorization bypass. The patch addresses the root cause by enforcing proper authorization validation before allowing site creation operations to proceed, ensuring that users can only create and manage sites within their authorized project scope.