CVE-2026-49228: Vvveb product authorization bypass allows Vendors to read, duplicate, or delete other Vendors' products
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product operations allow a low-privileged Vendor to access products owned by another Vendor. The admin/controller/product/products.php controller accepts a caller-controlled productid for duplicate and delete actions, and admin/sql/sqlite/product.sql loads and mutates products without consistently applying the current adminid when viewotherproducts or editotherproducts is absent. An attacker can read product details, duplicate products, or delete products and related catalog data, exposing commercial information and causing unauthorized copies, catalog pollution, data loss, or business disruption. This issue is fixed in version 1.0.8.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vvveb CMSto a version that resolves this vulnerability.Fixed in 1.0.8.4
Event History
Frequently Asked Questions
Which versions require remediation?
Vvveb versions prior to 1.0.8.4 are affected. The issue is fixed in version 1.0.8.4.
What access does an attacker need to exploit this issue?
A low-privileged Vendor account is sufficient. The attacker needs to control the product_id supplied to backend product duplicate or delete operations; no user interaction is required.
Are Vendors affected even when they are not allowed to view or edit other Vendors' products?
Vendor accounts without view_other_products or edit_other_products permissions are still exposed because product operations do not consistently restrict access to the current admin_id. Other Vendors' product details and related catalog data may be read, duplicated, or deleted.
What should administrators do if their deployment is vulnerable?
Upgrade to version 1.0.8.4. The provided data does not identify an alternative configuration-based mitigation.