CVE-2026-49224

Received Received - Intake

Privilege Escalation in Vvveb CMS via Post Revision Access

Publication date: 2026-08-18

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post revision operations allow a low-privileged Author to access revisions for posts owned by another Author. The admin/controller/content/revisions.php controller and admin/sql/sqlite/post_content_revision.sql queries trust caller-controlled post_id, language_id, and created_at values without consistently applying the current admin_id to revision lists, reads, restores, and deletes. An attacker can read historic post content, restore a revision over another Author's live post content, or delete revision records, exposing drafts, corrupting published content, and removing audit history. This issue is fixed in version 1.0.8.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-19

Generated

2026-09-07

AI Q&A

2026-08-18

EPSS Evaluated

2026-09-06

NVD

CVE-2026-49224

EUVD

EUVD-2026-61038

Affected Vendors & Products

Vendor	Product	Version / Range
vvveb	vvveb	1.0.8.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability in Vvveb CMS allows low-privileged Authors to access, modify, or delete post revisions belonging to other Authors without proper authorization. The issue occurs because the system does not consistently verify the admin_id (owner) when handling revisions, relying instead on parameters like post_id and language_id. This can lead to unauthorized reading of drafts, overwriting of live content, or deletion of revision history.

Detection Guidance

Check Vvveb CMS versions prior to 1.0.8.4 for unauthorized access to post revisions. Review logs for suspicious revision operations like deletions or restores by low-privileged users. Inspect database queries for missing admin_id filters in revision endpoints.

Impact Analysis

If exploited, this vulnerability could allow an attacker to read another Author's private drafts or old content, restore an old revision over a live post to corrupt its current content, or delete revision records to remove audit trails. This compromises data confidentiality, integrity, and availability for published and draft posts.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by exposing sensitive draft content or allowing unauthorized modifications to published content. Loss of revision history may also violate audit and data integrity requirements under these regulations.

Mitigation Strategies

Upgrade Vvveb CMS to version 1.0.8.4 or later. Implement capability checks for edit_other_posts permission before revision operations. Ensure SQL procedures include admin_id filters for revision access, modification, and deletion.

Hi! I’m here to help you understand CVE-2026-49224. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70