CVE-2026-49223

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-49223

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49223.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-49223

Aliases

GHSA-cj37-c5m2-3jmc

Published

2026-08-18T16:18:09Z

Modified

2026-09-10T03:30:30Z

Severity

7.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L CVSS Calculator

Summary

Vvveb product review authorization bypass allows Vendors to read, approve, edit, or delete reviews under other Vendors' products

Details

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operations allow a low-privileged Vendor to manage reviews under another Vendor's products. The admin/sql/sqlite/product_review.sql queries accept a caller-controlled product_review_id and do not verify product_review.product_id against product.admin_id for the current admin_id. An attacker can read pending review content, ratings, author information, and moderation state, change review status, edit review content, or delete reviews, manipulating product review visibility and integrity. This issue is fixed in version 1.0.8.4.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49223.json"
}

References

Affected packages

Git / github.com/givanz/vvveb

Affected ranges

Type

GIT

Repo

https://github.com/givanz/vvveb

Events

Introduced

Fixed

3d5c15dcf4b50e4580161f05cb9e643d834d044a

Fixed

9d94efb5d2dc3f116dfac4f691b6a4a3994fa710

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.0.8.4"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.7.1

1.0.7.2

1.0.7.3

1.0.8

1.0.8.1

1.0.8.2

1.0.8.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49223.json"