CVE-2026-49223: Vvveb CMS Privilege Escalation Vulnerability

CVE-2026-49223 Overview

CVE-2026-49223 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] in Vvveb, an open-source content management system with page builder capabilities for websites, blogs, and ecommerce stores. Versions prior to 1.0.8.4 fail to verify ownership of product reviews in backend operations. A low-privileged Vendor account can manipulate reviews belonging to another Vendor's products by supplying a chosen product_review_id. The SQL procedures in admin/sql/sqlite/product_review.sql do not validate product_review.product_id against product.admin_id for the acting admin_id. The vulnerability is fixed in version 1.0.8.4.

Critical Impact
Authenticated low-privileged Vendors can read, edit, change status, or delete other Vendors' product reviews, breaking marketplace integrity and moderation controls.

Affected Products

Vvveb CMS versions prior to 1.0.8.4
Vvveb backend product review operations (admin/sql/sqlite/product_review.sql, admin/sql/mysqli/product_review.sql, admin/sql/pgsql/product_review.sql)
Multi-vendor Vvveb ecommerce deployments

Discovery Timeline

2026-08-18 - CVE-2026-49223 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-49223

Vulnerability Analysis

The flaw is an IDOR in Vvveb's admin product review data layer. Backend review procedures accept a caller-controlled product_review_id without checking that the referenced review's parent product belongs to the acting administrator. Any authenticated Vendor can therefore address reviews outside their own product catalog.

Exploitation grants read access to pending review content, ratings, author information, and moderation state. It also allows write operations that change review status, edit review body content, or delete reviews entirely. In a multi-vendor marketplace this enables competitors to suppress negative reviews, publish or unpublish pending reviews, or tamper with ratings across the storefront.

Root Cause

The stored procedures in admin/sql/sqlite/product_review.sql (and the equivalent MySQL and PostgreSQL variants) omit an authorization predicate. Queries reference product_review.product_id but never join against product.admin_id for the current session's admin_id. The application enforces authentication but not object-level authorization, matching the pattern described in [CWE-639: Authorization Bypass Through User-Controlled Key].

Attack Vector

The attack requires a valid low-privileged Vendor account and network access to the admin interface. The attacker enumerates or guesses numeric product_review_id values and issues review list, read, edit, status change, or delete requests. No user interaction from the victim Vendor is required.

text

-- Product reviews (patched signature adds admin_id)

 	CREATE PROCEDURE getAll(
 		-- variables
-		IN  language_id INT,
-		IN  site_id INT,
-		IN 	product_id INT,
-		IN 	slug CHAR,
-        IN 	user_id INT,
-        IN 	status INT,
+		IN language_id INT,
+		IN site_id INT,
+		IN product_id INT,
+		IN slug CHAR,
+		IN user_id INT,
+		IN admin_id INT,
+		IN status INT,
 
 		-- pagination
 		IN start INT,

Source: GitHub Commit 3d5c15d. The patch introduces an admin_id parameter to review procedures and adds an edit_other_product capability check to gate list, read, edit, and delete operations against ownership.

Detection Methods for CVE-2026-49223

Indicators of Compromise

Admin HTTP requests to review endpoints referencing product_review_id values that map to products owned by a different admin_id.
Unexpected transitions in product_review.status (for example, pending to approved or approved to deleted) performed by non-owning Vendors.
Sequential enumeration patterns against review identifiers from a single authenticated Vendor session.

Detection Strategies

Correlate application audit logs of review edits, status changes, and deletes against product ownership records to flag cross-tenant actions.
Alert on Vendor accounts issuing review operations at rates or volumes inconsistent with the size of their own catalog.
Diff review content and moderation state over time to identify unauthorized modifications originating from non-owning administrators.

Monitoring Recommendations

Enable verbose logging on the Vvveb admin controller handling product reviews and forward events to a central SIEM or data lake.
Track failed and successful authorization checks after upgrading to 1.0.8.4 to confirm the edit_other_product capability is enforced.
Monitor database procedure invocations that reference product_review_id without a matching admin_id in the calling context.

How to Mitigate CVE-2026-49223

Immediate Actions Required

Upgrade Vvveb to version 1.0.8.4 or later, which introduces the admin_id parameter and edit_other_product capability check in product review procedures.
Audit historical review changes for evidence of cross-Vendor modification, restoring content from backups where tampering is confirmed.
Review and reduce Vendor role privileges so only trusted accounts hold the edit_other_product capability.

Patch Information

The fix is available in Vvveb Release 1.0.8.4. Technical details are documented in GHSA-cj37-c5m2-3jmc and implemented in commit 3d5c15d. The patch updates the SQLite, MySQL, and PostgreSQL variants of product_review.sql to accept admin_id and enforce ownership.

Workarounds

Restrict access to the Vvveb admin interface to trusted network ranges until the upgrade is applied.
Temporarily disable or suspend low-privileged Vendor accounts that do not require review moderation.
Add a reverse-proxy or WAF rule that blocks admin review endpoints for accounts outside an allowlist while patching is scheduled.

bash

# Upgrade Vvveb to the patched release
cd /path/to/vvveb
git fetch --tags
git checkout 1.0.8.4
# Verify the patched procedure signature includes admin_id
grep -n "admin_id" admin/sql/sqlite/product_review.sql
grep -n "admin_id" admin/sql/mysqli/product_review.sql
grep -n "admin_id" admin/sql/pgsql/product_review.sql