CVE-2026-49228
Received Received - Intake

Cross-Site Request Forgery in Vvveb CMS

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product operations allow a low-privileged Vendor to access products owned by another Vendor. The admin/controller/product/products.php controller accepts a caller-controlled product_id for duplicate and delete actions, and admin/sql/sqlite/product.sql loads and mutates products without consistently applying the current admin_id when view_other_products or edit_other_products is absent. An attacker can read product details, duplicate products, or delete products and related catalog data, exposing commercial information and causing unauthorized copies, catalog pollution, data loss, or business disruption. This issue is fixed in version 1.0.8.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-09-07
AI Q&A
2026-08-18
EPSS Evaluated
2026-09-06
NVD
CVE-2026-49228
EUVD
EUVD-2026-61035

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vvveb vvveb to 1.0.8.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Vvveb CMS allows a low-privileged Vendor to access, duplicate, or delete products owned by another Vendor. The issue occurs because the system does not consistently enforce ownership checks when performing product operations like viewing, duplicating, or deleting products.

Detection Guidance

Check Vvveb version with: grep -r "Vvveb" /path/to/installation | grep version. If version is below 1.0.8.4, the system is vulnerable. Inspect admin/controller/product/products.php for missing edit_other_products checks. Review SQL procedures in admin/sql/mysqli/product.sql and admin/sql/pgsql/product.sql for admin_id parameter usage.

Impact Analysis

An attacker could exploit this to read sensitive product details, create unauthorized copies of products, delete products or related catalog data, leading to commercial information exposure, catalog pollution, data loss, or business disruption.

Compliance Impact

This vulnerability could lead to unauthorized access and modification of sensitive data, potentially violating GDPR's data protection principles or HIPAA's integrity and confidentiality requirements. Compliance may be compromised due to unauthorized data exposure or loss.

Mitigation Strategies

Upgrade Vvveb to version 1.0.8.4 or later immediately. Apply the patch from commit 6db5257 to admin/controller/product/products.php and SQL procedures. Ensure all product operations enforce admin_id checks. Restrict Vendor access to only their own products until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49228. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart