CVE-2026-49227: Vvveb comment authorization bypass allows Authors to read, approve, edit, or delete comments under other Authors' posts
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend comment operations allow a low-privileged Author to manage comments under another Author's posts. The admin/controller/content/comment.php and admin/controller/content/comments.php controllers and the admin/sql/sqlite/comment.sql queries accept a caller-controlled commentid without verifying comment.postid against post.adminid for the current adminid. An attacker can read pending comment content and commenter email addresses, change moderation status, edit comment content, or delete comments, breaking author and moderation boundaries. This issue is fixed in version 1.0.8.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vvvebto a version that resolves this vulnerability.Fixed in 1.0.8.4
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Vvveb CMS installations running versions prior to 1.0.8.4 are affected when users have the low-privileged Author role and can access backend comment operations. The issue crosses author and moderation boundaries for comments on posts owned by other Authors.
What does an attacker need to exploit the vulnerability?
An attacker needs an authenticated Author-level account. No user interaction is required, and the attacker can supply a comment_id associated with another Author's post.
What should administrators do to remediate or reduce risk?
Upgrade Vvveb CMS to version 1.0.8.4, which fixes the missing ownership validation. If upgrading cannot occur immediately, restrict or suspend Author access to backend comment-management functions where operationally feasible.
How can administrators look for signs of exploitation?
Review comment-management activity by Author accounts for access to, moderation of, edits to, or deletion of comments attached to posts owned by other Authors. Also investigate unexpected exposure of pending comment content or commenter email addresses.