CVE-2026-49225
Received Received - Intake

Vvveb CMS Product Revision Access Control Flaw

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product revision operations allow a low-privileged Vendor to access revisions for products owned by another Vendor. The admin/controller/product/revisions.php route reuses admin/controller/content/revisions.php, while admin/sql/sqlite/product_content_revision.sql trusts caller-controlled product_id, language_id, and created_at values without applying the current admin_id to revision reads, restores, and deletes. An attacker can read historic product content, restore a revision over another Vendor's live product content, or delete revision records, exposing private copy, corrupting product pages, and removing audit history. This issue is fixed in version 1.0.8.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-09-07
AI Q&A
2026-08-18
EPSS Evaluated
2026-09-06
NVD
CVE-2026-49225
EUVD
EUVD-2026-61036

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vvveb vvveb 1.0.8.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-49225 is an authorization bypass vulnerability in the Vvveb CMS affecting versions 1.0.8.3 and earlier. It allows a low-privileged Vendor to access, restore, or delete another Vendor's product revisions without proper ownership verification. The issue occurs because the product revision system reuses generic endpoints without checking if the target product belongs to the current Vendor.

Detection Guidance

Check Vvveb versions for 1.0.8.3 or earlier. Review product revision logs for unauthorized access or modifications. Inspect database procedures for product_content_revision in MySQL, PostgreSQL, and SQLite for missing admin_id checks.

Impact Analysis

This vulnerability can lead to exposure of private product data, corruption of live product pages by restoring unauthorized revisions, and deletion of revision history. Attackers could read sensitive content, overwrite another Vendor's product pages, or remove audit trails, disrupting business operations and data integrity.

Compliance Impact

This vulnerability could violate compliance requirements by exposing sensitive data (GDPR Article 32, HIPAA Security Rule) and corrupting or deleting audit records (GDPR Article 30, HIPAA Audit Controls). Unauthorized data access or modification may lead to regulatory penalties and loss of trust.

Mitigation Strategies

Upgrade Vvveb to version 1.0.8.4 or later. Apply the commit e7413a2 to enforce admin_id checks in revision operations. Review and restrict Vendor permissions to prevent unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49225. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart