CVE-2026-49221
Received Received - Intake

Unauthorized Digital Asset Access in Vvveb CMS

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend digital asset operations allow a low-privileged Vendor to access digital assets linked to another Vendor's products. The admin/controller/product/digital-asset.php and admin/controller/product/digital-assets.php controllers and the admin/sql/sqlite/digital_asset.sql data queries use a caller-controlled digital_asset_id without consistently enforcing the current admin_id ownership boundary. An attacker can list assets, read asset names and file metadata, edit asset metadata, or delete asset records, which can disclose private product metadata, corrupt resource links, and cause data loss. This issue is fixed in version 1.0.8.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-09-07
AI Q&A
2026-08-18
EPSS Evaluated
2026-09-06
NVD
CVE-2026-49221
EUVD
EUVD-2026-61022

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vvveb vvveb 1.0.8.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Vvveb CMS prior to 1.0.8.4 has a vulnerability where low-privileged vendors can access digital assets linked to other vendors' products. The system fails to consistently enforce ownership boundaries, allowing attackers to list, read, edit, or delete asset records. This can lead to disclosure of private product metadata, corruption of resource links, and data loss.

Detection Guidance

To detect CVE-2026-49221, check if your Vvveb CMS version is below 1.0.8.4. Inspect the digital-asset.php and digital-assets.php files for missing admin_id ownership checks. Review SQL queries in digital_asset.sql for proper filtering. Test if low-privileged users can access or modify assets belonging to other vendors.

Impact Analysis

If exploited, this vulnerability could allow unauthorized access to sensitive product data, cause data corruption, or result in permanent data loss. Attackers might steal confidential information or disrupt operations by modifying or deleting critical assets.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by exposing or losing sensitive data. GDPR requires protecting personal data, while HIPAA mandates safeguarding health information. A breach could result in legal penalties or reputational damage.

Mitigation Strategies

Immediately upgrade Vvveb to version 1.0.8.4 or later to patch the vulnerability. Review digital asset access logs for unauthorized modifications or deletions. Restrict Vendor privileges to enforce ownership boundaries for digital assets.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49221. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart