CVE-2026-46408: Vvveb CMS Auth Bypass Vulnerability

CVE-2026-46408 Overview

CVE-2026-46408 is an Insecure Direct Object Reference (IDOR) vulnerability in Vvveb, an open-source content management system (CMS) with page builder capabilities for websites, blogs, and ecommerce stores. The checkout endpoint accepts a user-controlled cart_id parameter and enters the payment flow without verifying cart ownership. A logged-in attacker can reuse another user's cart data within their own checkout session. The flaw is tracked as [CWE-639: Authorization Bypass Through User-Controlled Key]. Vvveb resolved the issue in version 1.0.8.3.

Critical Impact

An authenticated attacker can manipulate the cart_id parameter to hijack another user's cart, exposing cart contents and enabling tampering with the checkout flow.

Affected Products

• Vvveb CMS versions prior to 1.0.8.3
• Vvveb ecommerce checkout module
• Deployments exposing the checkout endpoint to authenticated users

Discovery Timeline

• 2026-05-15 - CVE-2026-46408 published to NVD
• 2026-05-18 - Last updated in NVD database

Technical Details for CVE-2026-46408

Vulnerability Analysis

The vulnerability is an Insecure Direct Object Reference in the Vvveb checkout flow. The checkout endpoint accepts a cart_id value supplied by the client and uses it to look up the associated cart before initiating the payment workflow. The application does not verify that the authenticated session owns the referenced cart. As a result, any logged-in user can submit an arbitrary cart_id belonging to another customer and continue through checkout with that cart's contents.

The attacker requires only standard authenticated access, and the attack is executed over the network without user interaction from the victim. Impact includes disclosure of another user's cart contents, manipulation of the payment flow, and potential modification of order data tied to the victim's session.

Root Cause

The root cause is missing authorization on a sensitive object reference. The checkout controller trusts the cart_id parameter from the request without enforcing an ownership check that ties the cart to the current authenticated session. This pattern is classified under [CWE-639] and is a common business-logic flaw in ecommerce workflows.

Attack Vector

An attacker authenticates to the Vvveb application using any valid account. The attacker enumerates or guesses cart_id values associated with other users and submits a checkout request referencing one of those identifiers. The server returns the victim's cart data and proceeds into the payment flow without rejecting the cross-account reference. See the GitHub Security Advisory for vendor-published technical details.

Detection Methods for CVE-2026-46408

Indicators of Compromise

• Checkout requests where the submitted cart_id does not match any cart created by the requesting user's session.
• Repeated checkout or cart-access requests from a single account iterating through sequential or unrelated cart_id values.
• Order or payment records where the cart owner identifier differs from the checkout session user identifier.

Detection Strategies

• Add server-side logging that records the authenticated user ID alongside the cart_id submitted to the checkout endpoint, then alert on mismatches.
• Review web server and application logs for high-volume access to the checkout route with varying cart_id parameters from a single session or IP.
• Correlate cart creation events with checkout events to identify sessions completing checkout against carts they did not create.

Monitoring Recommendations

• Monitor authentication and session telemetry for accounts exhibiting unusual checkout request rates or parameter fuzzing patterns.
• Track database queries against the cart table that return rows owned by a user other than the request's authenticated user.
• Forward Vvveb application logs to a centralized analytics platform to enable cross-session correlation and historical hunting.

How to Mitigate CVE-2026-46408

Immediate Actions Required

• Upgrade all Vvveb installations to version 1.0.8.3 or later, which contains the official fix.
• Audit recent checkout and order records for cross-account cart references and notify affected customers if abuse is identified.
• Invalidate active sessions after upgrading to force re-authentication and clear any in-progress malicious checkout flows.

Patch Information

Vvveb addressed CVE-2026-46408 in release 1.0.8.3. The fix enforces an ownership check that verifies the authenticated user owns the cart referenced by cart_id before the checkout flow proceeds. Refer to the GitHub Security Advisory GHSA-rmh2-wv73-xpqh for the upstream commit and remediation details.

Workarounds

• If immediate upgrade is not possible, restrict access to the checkout endpoint behind additional authorization middleware that compares the submitted cart_id to the session's cart record.
• Temporarily disable guest-to-authenticated cart transfer features that rely on client-supplied cart_id values.
• Apply web application firewall rules to block checkout requests where the cart_id parameter does not match a recently created cart for the same session cookie.

# Configuration example: upgrade Vvveb to the fixed release
git fetch --tags
git checkout 1.0.8.3
composer install --no-dev --optimize-autoloader
php bin/console cache:clear