This vulnerability allows unauthenticated attackers to retrieve the application's secret cron key via the cron controller, exposing sensitive configuration. This disclosure can enable attackers to trigger scheduled tasks outside the intended schedule, potentially leading to unauthorized code execution or data manipulation.

The issue affects the Vvveb content management system from givanz, versions older than 1.0.8.2. After 1.0.8.2 the cron key is no longer publicly exposed. The vulnerability is limited to the cron controller endpoint and does not require pre‑existing authentication.

The CVSS score of 6.9 indicates a medium risk, and the vulnerability is exploitable over the network by anyone who can reach the cron controller endpoint. There is currently no EPSS data and the flaw is not listed in the KEV catalog. Attackers can simply request the cron controller URL and capture the exposed key. Once the key is known, they can invoke the cron job API to execute tasks at will, bypassing normal scheduling controls.