CVE-2026-49227
Received Received - Intake

Stored XSS in Vvveb CMS

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend comment operations allow a low-privileged Author to manage comments under another Author's posts. The admin/controller/content/comment.php and admin/controller/content/comments.php controllers and the admin/sql/sqlite/comment.sql queries accept a caller-controlled comment_id without verifying comment.post_id against post.admin_id for the current admin_id. An attacker can read pending comment content and commenter email addresses, change moderation status, edit comment content, or delete comments, breaking author and moderation boundaries. This issue is fixed in version 1.0.8.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-09-07
AI Q&A
2026-08-18
EPSS Evaluated
2026-09-06
NVD
CVE-2026-49227
EUVD
EUVD-2026-61023

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vvveb vvveb to 1.0.8.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Vvveb CMS versions prior to 1.0.8.4 allows low-privileged users called Authors to manage comments under other Authors' posts without proper authorization checks. The system fails to verify if a comment belongs to the current user's posts before allowing modifications, enabling attackers to read, edit, delete, or change moderation status of comments they do not own.

Detection Guidance

Detecting this vulnerability requires checking the Vvveb CMS version and reviewing comment management permissions. Check the installed version in the Vvveb admin panel or database. Look for unauthorized comment modifications, deletions, or access to pending comments by low-privileged users. Review logs for suspicious activity in admin/controller/content/comment.php and admin/controller/content/comments.php.

Impact Analysis

If exploited, this vulnerability could allow unauthorized users to access sensitive comment data such as pending comments and commenter email addresses. Attackers could also alter or delete comments, disrupting content integrity and moderation processes. This undermines trust in the platform and may lead to data leaks or misinformation.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data such as email addresses in comments, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage due to insufficient data safeguards.

Mitigation Strategies

Immediately upgrade Vvveb CMS to version 1.0.8.4 or later. Review and restrict comment management permissions for Authors. Audit all comments for unauthorized changes or deletions. Monitor admin logs for suspicious activity. Ensure post ownership verification is enforced in comment operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49227. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart