CVE-2026-49227
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Vvveb before version 1.0.8.4 has a vulnerability in backend comment operations that allows a low-privileged Author to manage comments under another Author's posts. Lack of ownership verification enables reading comment content, email addresses, changing moderation status, editing or deleting comments.
Risk Assessment
Breaking author and moderation boundaries can lead to disclosure of private content, comment manipulation, and data loss, affecting content integrity and confidentiality.
Recommendation
Upgrade Vvveb to version 1.0.8.4 or later, which includes the fix.
Original NVD description (English source)
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend comment operations allow a low-privileged Author to manage comments under another Author's posts. The admin/controller/content/comment.php and admin/controller/content/comments.php controllers and the admin/sql/sqlite/comment.sql queries accept a caller-controlled comment_id without verifying comment.post_id against post.admin_id for the current admin_id. An attacker can read pending comment content and commenter email addresses, change moderation status, edit comment content, or delete comments, breaking author and moderation boundaries. This issue is fixed in version 1.0.8.4.