givanz Vvveb up to 1.0.8.3 Checkout Endpoint cart_id authorization
| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 6.8 | $0-$5k | 0.00 |
Summary
A vulnerability was found in givanz Vvveb up to 1.0.8.3 and classified as critical. This affects an unknown part of the component Checkout Endpoint. Such manipulation of the argument cart_id leads to authorization. This vulnerability is documented as CVE-2026-46408. The attack can be executed remotely. There is not any exploit available. It is suggested to upgrade the affected component.
Details
A vulnerability was found in givanz Vvveb up to 1.0.8.3. It has been rated as critical. Affected by this issue is an unknown code of the component Checkout Endpoint. The manipulation of the argument cart_id with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-639. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. Impacted is confidentiality, integrity, and availability. CVE summarizes:
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, the checkout endpoint accepts a user-controlled cart_id and uses it to enter the payment flow without verifying cart ownership. A logged-in attacker can therefore reuse another user's cart data in their own checkout session. This vulnerability is fixed in 1.0.8.3.
The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-46408 since 05/13/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available.
Upgrading to version 1.0.8.3 eliminates this vulnerability.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Product
Vendor
Name
Version
Website
- Product: https://github.com/givanz/Vvveb/
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔒VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 6.9VulDB Meta Temp Score: 6.8
VulDB Base Score: 6.3
VulDB Temp Score: 6.0
VulDB Vector: 🔒
VulDB Reliability: 🔍
CNA Base Score: 7.6
CNA Vector (GitHub_M): 🔒
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔒
VulDB Temp Score: 🔒
VulDB Reliability: 🔍
Exploiting
Class: AuthorizationCWE: CWE-639 / CWE-285 / CWE-266
CAPEC: 🔒
ATT&CK: 🔒
Physical: No
Local: No
Remote: Yes
Availability: 🔒
Status: Not defined
EPSS Score: 🔒
EPSS Percentile: 🔒
Price Prediction: 🔍
Current Price Estimation: 🔒
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔒
Upgrade: Vvveb 1.0.8.3
Timeline
05/13/2026 CVE reserved05/16/2026 Advisory disclosed
05/16/2026 VulDB entry created
05/16/2026 VulDB entry last update
Sources
Product: github.comAdvisory: GHSA-rmh2-wv73-xpqh
Status: Confirmed
CVE: CVE-2026-46408 (🔒)
GCVE (CVE): GCVE-0-2026-46408
GCVE (VulDB): GCVE-100-364256
Entry
Created: 05/16/2026 06:40Changes: 05/16/2026 06:40 (65)
Complete: 🔍
Cache ID: 216::103
VulDB is the best source for vulnerability data and more expert information about this specific topic.
No comments yet. Languages: en.
Please log in to comment.