CVE-2026-49224: Vvveb post revision authorization bypass allows Authors to read, restore, or delete other Authors' post revisions
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post revision operations allow a low-privileged Author to access revisions for posts owned by another Author. The admin/controller/content/revisions.php controller and admin/sql/sqlite/postcontentrevision.sql queries trust caller-controlled postid, languageid, and createdat values without consistently applying the current adminid to revision lists, reads, restores, and deletes. An attacker can read historic post content, restore a revision over another Author's live post content, or delete revision records, exposing drafts, corrupting published content, and removing audit history. This issue is fixed in version 1.0.8.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vvvebto a version that resolves this vulnerability.Fixed in 1.0.8.4
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Vvveb installations running versions before 1.0.8.4 are affected when multiple Author-level backend accounts can manage posts. The issue crosses Author ownership boundaries: one Author can target revisions belonging to another Author.
What access does an attacker need to exploit it?
An attacker needs an authenticated low-privileged Author account and access to backend post revision operations. No user interaction is required, and the attacker can supply post_id, language_id, and created_at values to target another Author's revisions.
What should be done if patching is not immediately possible?
Upgrade Vvveb to version 1.0.8.4, which fixes the authorization checks for revision operations. If upgrading cannot happen immediately, restrict or disable Author access to backend revision functionality and limit Author accounts to trusted users.
How can administrators look for possible exploitation?
Review revision activity and post-content changes for cases where an Author accessed, restored, or deleted revisions associated with posts they do not own. Investigate unexpected restoration of older content, missing revision records, and exposure of draft or historic content across Author accounts.