CVE-2026-49223 in Vvveb
Summary
by MITRE • 08/18/2026
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operations allow a low-privileged Vendor to manage reviews under another Vendor's products. The admin/sql/sqlite/product_review.sql queries accept a caller-controlled product_review_id and do not verify product_review.product_id against product.admin_id for the current admin_id. An attacker can read pending review content, ratings, author information, and moderation state, change review status, edit review content, or delete reviews, manipulating product review visibility and integrity. This issue is fixed in version 1.0.8.4.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/18/2026
Vvveb CMS versions prior to 1.0.8.4 contain a critical authorization flaw within its backend administrative interface that allows for the unauthorized manipulation of product reviews across different vendor accounts. The vulnerability stems from an insecure direct object reference mechanism in the SQL query handling product review operations, specifically located in the admin/sql/sqlite/product_review.sql module. This component accepts a caller-controlled parameter representing the product_review_id without performing adequate access control checks to ensure that the requesting administrator has ownership or administrative rights over the specific product associated with the targeted review.
The technical root cause is a failure to verify the relationship between the authenticated user's identity and the resource being accessed. When an admin session initiates a request to manage a product review, the system retrieves the record based solely on the provided identifier but fails to cross-reference the product_review.product_id against the current administrator's unique administrative ID or vendor affiliation. This logic gap effectively bypasses role-based access controls, allowing any authenticated user with low-privilege Vendor status to interact with data belonging to other vendors within the same platform instance.
The operational impact of this vulnerability is significant for multi-vendor e-commerce environments relying on Vvveb CMS. An attacker exploiting this flaw can read sensitive information including pending review content, customer ratings, author details, and internal moderation states that are intended to be private or restricted to specific vendors. Furthermore, the lack of authorization checks permits malicious actors to alter the status of reviews, edit their textual content to defraud customers or damage competitors' reputations, or delete reviews entirely. This compromises both data integrity and confidentiality, potentially leading to unfair competitive practices and erosion of trust in the platform's review system.
This vulnerability aligns with CWE-862, which describes Missing Authorization, as well as CWE-639 related to Inadequate Encryption of Sensitive Data if the read access leads to exposure of personally identifiable information or proprietary business data. From a threat modeling perspective using the MITRE ATT&CK framework, this behavior corresponds to T1078 Valid Accounts for initial access persistence and potentially T1530 Data from Information Repositories during the collection phase, as well as T1499 Endpoint Denial of Service if reviews are deleted en masse.
To mitigate this risk, administrators must upgrade immediately to Vvveb CMS version 1.0.8.4 or later where these authorization checks have been implemented. In addition to upgrading, it is recommended that developers implement strict object-level permission verification in all backend API endpoints and database queries involving user-specific data. This includes ensuring that every request validates the ownership of the resource against the session's authenticated identity before executing any read, write, update, or delete operations. Regular security audits focusing on access control logic are also advised to prevent similar bypasses in other modules of the content management system.