CVE-2026-49226: Vvveb post authorization bypass allows Authors to view, duplicate, or delete other Authors' posts
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post operations allow a low-privileged Author to access posts owned by another Author. The admin/controller/content/posts.php controller permits filter[adminid] to replace the server-selected adminid restriction and accepts a caller-controlled postid for duplicate and delete actions, while admin/sql/sqlite/post.sql does not consistently enforce post.adminid. An attacker can view post metadata, discover post identifiers, duplicate posts, or delete posts and related content, exposing private drafts and causing content pollution, data loss, or business disruption. This issue is fixed in version 1.0.8.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vvveb backend post operationsto a version that resolves this vulnerability.Fixed in 1.0.8.4
Event History
Frequently Asked Questions
Which Vvveb versions require remediation?
Vvveb versions prior to 1.0.8.4 are affected. The issue is fixed in version 1.0.8.4.
What level of access is required to exploit this issue?
An attacker needs a low-privileged Author account; no user interaction is required. They can manipulate backend post-operation parameters to target posts owned by other Authors.
What could an attacker do after exploiting the flaw?
Posts belonging to other Authors may be exposed through metadata and post identifiers, then duplicated or deleted along with related content. Private drafts can be disclosed, and deletion or duplication can cause data loss or content pollution.