CVE-2026-49223: Vvveb product review authorization bypass allows Vendors to read, approve, edit, or delete reviews under other Vendors' products
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operations allow a low-privileged Vendor to manage reviews under another Vendor's products. The admin/sql/sqlite/productreview.sql queries accept a caller-controlled productreviewid and do not verify productreview.productid against product.adminid for the current adminid. An attacker can read pending review content, ratings, author information, and moderation state, change review status, edit review content, or delete reviews, manipulating product review visibility and integrity. This issue is fixed in version 1.0.8.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vvveb backend product review operationsto a version that resolves this vulnerability.Fixed in 1.0.8.4 - Compensating control
Ensure low-privileged Vendor accounts cannot access product review endpoints/queries for other Vendors' products (e.g., enforce authorization checks so product_review.product_id is validated against the current admin_id before allowing read/approve/edit/delete).
Event History
Frequently Asked Questions
Who is exposed to this issue?
Vvveb installations prior to version 1.0.8.4 are affected where low-privileged Vendor accounts can access backend product-review operations. An authenticated Vendor can target reviews associated with products administered by other Vendors.
What does an attacker need to exploit it?
An attacker needs a low-privileged Vendor account and a product_review_id for a review belonging to another Vendor's product. No user interaction is required.
What impact can exploitation have?
An attacker may read pending review content, ratings, author information, and moderation state. They can also approve or otherwise change review status, edit review content, or delete reviews belonging to other Vendors' products.
What is the remediation?
Upgrade Vvveb to version 1.0.8.4, which fixes the missing ownership verification in product-review operations.