CVE-2026-49223
Received Received - Intake

Unauthorized Review Manipulation in Vvveb CMS

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operations allow a low-privileged Vendor to manage reviews under another Vendor's products. The admin/sql/sqlite/product_review.sql queries accept a caller-controlled product_review_id and do not verify product_review.product_id against product.admin_id for the current admin_id. An attacker can read pending review content, ratings, author information, and moderation state, change review status, edit review content, or delete reviews, manipulating product review visibility and integrity. This issue is fixed in version 1.0.8.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-09-08
AI Q&A
2026-08-18
EPSS Evaluated
2026-09-06
NVD
CVE-2026-49223
EUVD
EUVD-2026-61039

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vvveb vvveb to 1.0.8.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Vvveb CMS before version 1.0.8.4 allows a low-privileged Vendor to manipulate product reviews belonging to other Vendors. The issue occurs because backend operations do not properly verify that a review belongs to the Vendor's own products before allowing modifications. An attacker can read, edit, or delete reviews, altering product visibility and integrity.

Detection Guidance

To detect this vulnerability, check the installed version of Vvveb. If it is below 1.0.8.4, the system is vulnerable. Review database queries related to product reviews for improper access controls. Look for unauthorized modifications to reviews, such as changes to status, content, or deletion of reviews not belonging to the current admin.

Impact Analysis

If you are a Vvveb user running a version before 1.0.8.4, an attacker with Vendor access could manipulate reviews for your products. This could lead to false information being displayed, reputational damage, or loss of customer trust due to altered ratings or content.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized access to and manipulation of product reviews. Under GDPR, unauthorized access to personal data (such as review author information) may constitute a data breach. HIPAA requires strict access controls for sensitive health-related data, and unauthorized review modifications could compromise integrity. The flaw enables low-privileged users to read, edit, or delete reviews belonging to other vendors, which may include sensitive customer feedback or personal details.

Mitigation Strategies

Immediately update Vvveb to version 1.0.8.4 or later. Review and audit all product review records for unauthorized changes. Restrict vendor access to only necessary product reviews and enforce strict product ownership checks in the backend.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49223. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart