CVE-2026-29789

Name of the Vulnerable Software and Affected Versions Vito versions prior to 3.20.3

Description Vito is a self-hosted web application used for managing servers and deploying PHP applications. A missing authorization check in workflow site-creation actions allows an authenticated attacker with workflow write access in one project to create and manage sites on servers belonging to other projects by providing a foreign server id. The issue affects the workflow site-creation actions.

Recommendations Update to version 3.20.3 or later.