CVE-2026-49226

Received Received - Intake

Unauthorized Post Access in Vvveb CMS

Publication date: 2026-08-18

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post operations allow a low-privileged Author to access posts owned by another Author. The admin/controller/content/posts.php controller permits filter[admin_id] to replace the server-selected admin_id restriction and accepts a caller-controlled post_id for duplicate and delete actions, while admin/sql/sqlite/post.sql does not consistently enforce post.admin_id. An attacker can view post metadata, discover post identifiers, duplicate posts, or delete posts and related content, exposing private drafts and causing content pollution, data loss, or business disruption. This issue is fixed in version 1.0.8.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-19

Generated

2026-09-08

AI Q&A

2026-08-18

EPSS Evaluated

2026-09-06

NVD

CVE-2026-49226

EUVD

EUVD-2026-61024

Affected Vendors & Products

Vendor	Product	Version / Range
vvveb	vvveb	1.0.8.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

CVE-2026-49226 is an authorization bypass vulnerability in the Vvveb CMS affecting versions 1.0.8.3 and earlier. It allows low-privileged Authors to access, duplicate, or delete posts owned by other Authors by manipulating the filter[admin_id] parameter or submitting unauthorized post IDs to endpoints without proper ownership verification.

Detection Guidance

To detect this vulnerability, check if your Vvveb CMS version is 1.0.8.3 or earlier. Inspect network traffic for unauthorized post operations by Authors, such as duplicate or delete requests with manipulated post IDs. Look for suspicious use of the filter[admin_id] parameter in post listings.

Impact Analysis

An attacker with Author privileges could view private drafts or post metadata, duplicate posts without consent, delete posts causing data loss, or disrupt business operations. The vulnerability exposes confidential content and allows unauthorized modifications to website content.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's confidentiality requirements. Exposure of private drafts or metadata may result in non-compliance with privacy regulations, potential data breaches, and associated legal penalties.

Mitigation Strategies

Immediately upgrade Vvveb to version 1.0.8.4 or later. Ensure all post operations enforce ownership checks and remove the filter[admin_id] parameter override unless the user has view_other_posts privileges. Apply SQL updates to restrict deletions to authorized posts only.

Hi! I’m here to help you understand CVE-2026-49226. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70