CVE-2026-49222: Vvveb product question authorization bypass allows Vendors to read, approve, edit, or delete questions under other Vendors' products
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product question operations allow a low-privileged Vendor to manage questions under another Vendor's products. The admin/sql/sqlite/productquestion.sql queries accept a caller-controlled productquestionid and do not verify productquestion.productid against product.adminid for the current adminid. An attacker can read pending question content and moderation data, change question status, edit question content, or delete questions, manipulating product Q&A visibility and integrity. This issue is fixed in version 1.0.8.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vvveb backend product question operationsto a version that resolves this vulnerability.Fixed in 1.0.8.4
Event History
Frequently Asked Questions
Which deployments and users are exposed?
Vvveb installations prior to version 1.0.8.4 are affected when they allow low-privileged Vendor accounts to use backend product-question operations. The issue concerns questions associated with products owned by other Vendors.
What access does an attacker need to exploit this issue?
An attacker needs a low-privileged Vendor account and a caller-controlled product_question_id for a question under another Vendor's product. No user interaction is required.
What is the remediation?
Upgrade Vvveb to version 1.0.8.4, which fixes the authorization validation for these operations.
How can I determine whether the issue may have been exploited?
Review whether Vendor accounts can access backend product-question operations and test whether changing a product_question_id permits access to questions belonging to another Vendor's product. Relevant impact includes reading pending question and moderation data, changing status or content, and deleting questions.