CVE-2026-49221: Vvveb CMS Information Disclosure Flaw

CVE-2026-49221 Overview

CVE-2026-49221 is a broken access control vulnerability in Vvveb, an open-source CMS with page builder functionality for websites, blogs, and ecommerce stores. Versions prior to 1.0.8.4 allow a low-privileged Vendor account to access digital assets owned by other Vendors. The admin/controller/product/digital-asset.php and admin/controller/product/digital-assets.php controllers accept a caller-controlled digital_asset_id without enforcing the current admin_id ownership boundary. The flaw is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
An authenticated Vendor can list, read, modify, or delete digital asset records belonging to other Vendors, resulting in disclosure of private product metadata, corruption of resource links, and data loss.

Affected Products

Vvveb CMS versions prior to 1.0.8.4
admin/controller/product/digital-asset.php controller
admin/controller/product/digital-assets.php controller

Discovery Timeline

2026-08-18 - CVE-2026-49221 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-49221

Vulnerability Analysis

The vulnerability resides in Vvveb's backend digital asset management workflow. The controllers admin/controller/product/digital-asset.php and admin/controller/product/digital-assets.php expose CRUD operations for digital assets attached to products. The SQL statements in admin/sql/sqlite/digital_asset.sql accept a digital_asset_id supplied by the caller and return or modify the matching row without validating that the record belongs to the requesting Vendor's admin_id.

A low-privileged Vendor user, who legitimately holds credentials to manage their own products, can substitute another Vendor's digital_asset_id in list, read, edit, and delete requests. The system honors the request because the ownership constraint is never applied consistently across all handlers. This exposes private product metadata, allows tampering with asset names and file references, and permits destruction of another Vendor's asset records.

Root Cause

The root cause is missing authorization enforcement at the data-access layer. Digital asset queries filter by digital_asset_id alone rather than composing the query with the authenticated admin_id. There is no server-side capability check confirming that the caller holds the edit_other_product permission before returning or mutating the record.

Attack Vector

Exploitation requires an authenticated Vendor account and network access to the admin interface. The attacker issues normal admin requests to the digital asset endpoints, substituting arbitrary digital_asset_id values. No user interaction from another account is required, and the attack executes over the standard authenticated HTTP session.

php

// Patch: admin/controller/product/digital-asset.php
 use Vvveb\Controller\Crud;
 use Vvveb\System\Images;
 use Vvveb\System\Traits\Media as MediaTrait;
+use Vvveb\System\User\Admin;
 
 class DigitalAsset extends Crud {
 	use MediaTrait;

// Patch: admin/controller/product/digital-assets.php
 namespace Vvveb\Controller\Product;
 
 use Vvveb\Controller\Listing;
+use Vvveb\System\User\Admin;
 
 class DigitalAssets extends Listing {
 	protected $additionalPermissionCheck = ['product/digital-asset/save'];

Source: GitHub Commit 0463ae6. The patch imports the Admin user helper and adds a capability check so that only callers with the edit_other_product permission can operate on assets belonging to other Vendors.

Detection Methods for CVE-2026-49221

Indicators of Compromise

Admin access log entries showing a single Vendor account issuing requests to product/digital-asset or product/digital-assets with digital_asset_id values that do not map to the caller's own products.
Unexpected modifications or deletions in the digital_asset table where the record's owning admin_id differs from the acting session's admin_id.
Broken product download links or missing file references reported by Vendors who did not initiate the change.

Detection Strategies

Compare each digital asset write operation in application logs against the owning admin_id recorded in the database, and alert on mismatches.
Enable audit logging on the Vvveb admin routes and flag enumeration patterns against sequential digital_asset_id values from a single session.
Review database change-data-capture streams for UPDATE or DELETE statements on digital_asset rows issued by Vendors that do not own the target row.

Monitoring Recommendations

Baseline normal Vendor activity on digital asset endpoints and alert when a session accesses more distinct asset IDs than the number of products it owns.
Monitor for HTTP 200 responses on digital asset routes followed by rapid successive requests, which suggest scripted enumeration.
Track error-free DELETE operations on digital_asset outside of standard product lifecycle workflows.

How to Mitigate CVE-2026-49221

Immediate Actions Required

Upgrade Vvveb to version 1.0.8.4 or later, which introduces the edit_other_product capability check across digital asset controllers.
Audit existing Vendor accounts and revoke unnecessary privileges to reduce the pool of accounts capable of exploiting the flaw before patching.
Review the digital_asset table for unexpected changes since the vulnerable version was deployed and restore affected records from backup where necessary.

Patch Information

The fix is available in Vvveb 1.0.8.4. See the GitHub Release 1.0.8.4 and the GitHub Security Advisory GHSA-chpc-xj4m-9g3j. The patch commit adds the Vvveb\System\User\Admin import and enforces capability checks in the affected controllers.

Workarounds

Restrict the admin interface to trusted network segments using a web application firewall or reverse-proxy allowlist until the upgrade can be applied.
Temporarily disable Vendor-role logins on multi-tenant deployments and require administrator sign-off for digital asset operations.
Add server-side request logging to capture full digital_asset_id parameters for forensic review during the patch window.

bash

# Upgrade Vvveb to the patched release
cd /path/to/vvveb
git fetch --tags
git checkout 1.0.8.4
# Or download the release archive
curl -L -o vvveb-1.0.8.4.zip \
  https://github.com/givanz/Vvveb/archive/refs/tags/1.0.8.4.zip
unzip vvveb-1.0.8.4.zip