CVE-2026-126373: Vvveb 1.0.8.4 through 1.0.8.6 Authorization Bypass via Post Revisions
Vvveb 1.0.8.4 through 1.0.8.6 contains an authorization bypass vulnerability in the content/revisions revision action that lets low-privileged Authors read other authors' revisions. Attackers can supply a postid, languageid, and createdat timestamp to retrieve private unpublished drafts, because the revision() action lacks the adminid ownership restriction.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with the low-privileged Author role can exploit it. The attacker does not need administrator privileges or user interaction.
What information does an attacker need to retrieve a revision?
The attacker must supply a post_id, language_id, and created_at timestamp for the targeted revision. These values can be used to request revisions belonging to other authors.
What data can be exposed?
The issue can expose other authors' private, unpublished draft content stored in post revisions. The provided impact information indicates confidentiality impact only, with no integrity or availability impact.
How can I determine whether an installation is affected?
Installations running Vvveb versions 1.0.8.4 through 1.0.8.6 are affected according to the provided data. Review whether Author-role accounts can access the content/revisions revision action for post revisions they do not own.