Authorization Bypass in Vvveb CMS via admin_id Filter

Executive Summary

This vulnerability in Vvveb versions 1.0.8.4 through 1.0.8.6 allows low-privilege users like authors and vendors to bypass admin_id owner scoping and access other users' records. Attackers can manipulate filter[admin_id] to list drafts, duplicate posts or products, or enumerate digital-asset metadata belonging to other vendors.

Useful 0 Not Useful 0

Impact Analysis

If you are a user of Vvveb, this vulnerability could allow unauthorized access to your sensitive data such as drafts, posts, products, or digital assets. Attackers with low privileges may exploit this to steal or manipulate your information, leading to data breaches or unauthorized modifications.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Organizations using Vvveb may face compliance violations, legal penalties, and reputational damage due to potential data exposure.

Useful 0 Not Useful 0

Mitigation Strategies

Update Vvveb to the latest version beyond 1.0.8.6 to ensure the authorization fix is complete. Review and restrict access controls for low-privilege authors and vendors to prevent unauthorized access to other users' records.

Useful 0 Not Useful 0