CVE-2026-49221: Vvveb digital asset authorization bypass allows Vendors to list, read, edit, or delete other Vendors' digital assets
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend digital asset operations allow a low-privileged Vendor to access digital assets linked to another Vendor's products. The admin/controller/product/digital-asset.php and admin/controller/product/digital-assets.php controllers and the admin/sql/sqlite/digitalasset.sql data queries use a caller-controlled digitalassetid without consistently enforcing the current adminid ownership boundary. An attacker can list assets, read asset names and file metadata, edit asset metadata, or delete asset records, which can disclose private product metadata, corrupt resource links, and cause data loss. This issue is fixed in version 1.0.8.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vvvebto a version that resolves this vulnerability.Fixed in 1.0.8.4
Event History
Frequently Asked Questions
Which deployments are exposed?
Vvveb installations prior to 1.0.8.4 are affected when they allow low-privileged Vendor users to use backend digital asset operations. The issue crosses the intended ownership boundary between Vendors' product-linked digital assets.
What access does an attacker need?
An attacker needs a low-privileged Vendor account and a digital_asset_id associated with another Vendor. No user interaction is required, and the vulnerable operations are reachable over the network.
What is the remediation?
Upgrade Vvveb to version 1.0.8.4, which fixes the ownership checks for the affected digital asset operations.
How can administrators look for evidence of impact?
Review digital asset records and associated product resource links for unexpected metadata changes, deletions, or cross-Vendor access. Affected operations can list assets, expose asset names and file metadata, modify metadata, and delete asset records.