CVE-2026-126376: Vvveb 1.0.8.4 through 1.0.8.6 BOLA via Posts, Products, and Digital Assets
Vvveb 1.0.8.4 through 1.0.8.6 contains an incomplete authorization fix that allows low-privilege authors and vendors to access other users' records by bypassing adminid owner scoping. Attackers can supply filter[adminid] to list drafts, invoke duplicate() on posts or products, or enumerate every vendor's digital-asset metadata.
Affected Software
Event History
Frequently Asked Questions
Which accounts are exposed to this issue?
Low-privilege author and vendor accounts are able to access records belonging to other users. The affected functionality includes posts, products, and digital-asset metadata.
What does an attacker need to exploit it?
The attacker needs a low-privilege authenticated author or vendor account. They can supply filter[admin_id] to list drafts, call duplicate() on posts or products, or enumerate digital-asset metadata across vendors.
How can I determine whether the issue affects my deployment?
Deployments running Vvveb versions 1.0.8.4 through 1.0.8.6 are affected according to the available information. A practical verification is to test, using a low-privilege author or vendor account, whether changing filter[admin_id] exposes another user's drafts or whether cross-owner duplication and digital-asset metadata enumeration are possible.