givanz Vvveb up to 1.0.8.3 Product Question Operations product_question.sql product_question_id access control

Summaryinfo

A vulnerability marked as critical has been reported in givanz Vvveb. This impacts an unknown function of the file admin/sql/sqlite/product_question.sql of the component Product Question Operations. The manipulation of the argument product_question_id leads to access control. This vulnerability is traded as CVE-2026-49222. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in givanz Vvveb and classified as critical. This issue affects an unknown code of the file admin/sql/sqlite/product_question.sql of the component Product Question Operations. The manipulation of the argument product_question_id with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product question operations allow a low-privileged Vendor to manage questions under another Vendor's products. The admin/sql/sqlite/product_question.sql queries accept a caller-controlled product_question_id and do not verify product_question.product_id against product.admin_id for the current admin_id. An attacker can read pending question content and moderation data, change question status, edit question content, or delete questions, manipulating product Q&A visibility and integrity. This issue is fixed in version 1.0.8.4.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-49222 since 05/28/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

By approaching the search of inurl:admin/sql/sqlite/product_question.sql it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.0.8.4 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• givanz

Name

• Vvveb

Version

• 1.0.5
• 1.0.6
• 1.0.6.1
• 1.0.7
• 1.0.7.2
• 1.0.8
• 1.0.8.1
• 1.0.8.2
• 1.0.8.3

Website

• Product: https://github.com/givanz/Vvveb/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion