CVE-2026-49224: Vvveb CMS Privilege Escalation Vulnerability

CVE-2026-49224 Overview

CVE-2026-49224 is an Insecure Direct Object Reference (IDOR) vulnerability in Vvveb, a content management system (CMS) with page builder capabilities for websites, blogs, and ecommerce stores. Versions prior to 1.0.8.4 allow a low-privileged Author account to access post revisions belonging to other Authors. The admin/controller/content/revisions.php controller and the admin/sql/sqlite/post_content_revision.sql queries trust caller-controlled post_id, language_id, and created_at values without enforcing the current admin_id. Attackers can read drafts, restore a revision over another Author's live content, or delete revision records. The issue is fixed in version 1.0.8.4.

Critical Impact
An authenticated low-privileged Author can read, overwrite, or delete post revisions owned by other Authors, exposing drafts, corrupting published content, and erasing audit history.

Affected Products

Vvveb CMS versions prior to 1.0.8.4
admin/controller/content/revisions.php component
admin/sql/sqlite/post_content_revision.sql and admin/sql/mysqli/post_content_revision.sql stored queries

Discovery Timeline

2026-08-18 - CVE-2026-49224 published to the National Vulnerability Database (NVD)
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-49224

Vulnerability Analysis

The vulnerability is an Insecure Direct Object Reference [CWE-639] in the post revision workflow of Vvveb. The revision controller accepts post_id, language_id, and created_at parameters from the request and executes list, read, restore, and delete operations on the matching revision records. These operations do not consistently scope queries to the authenticated admin_id, so any Author can act on revisions owned by another Author.

A low-privileged Author who should only manage their own posts can therefore read historic content of posts belonging to peers, roll back another Author's live post to an attacker-chosen revision, or delete revision rows entirely. The impact spans confidentiality (unpublished draft disclosure), integrity (content corruption via restore), and availability of audit history (revision deletion).

Root Cause

The stored SQL procedures for post revision list, read, restore, and delete did not accept or filter on the acting administrator's identifier. Authorization was implied by knowledge of the post_id rather than enforced by ownership. Callers with any Author-level session could supply arbitrary identifiers and receive results.

Attack Vector

Exploitation requires only authenticated Author-level access to the Vvveb backend over the network. The attacker submits crafted revision requests referencing another Author's post_id and revision timestamp. No user interaction from the victim is required.

php

// Patch excerpt: admin/controller/content/revisions.php
 use function Vvveb\humanReadable;
 use function Vvveb\model;
 use Vvveb\System\Images;
+use Vvveb\System\User\Admin;
 
 class Revisions extends Base {
 	protected $type = 'post';
// Source: https://github.com/givanz/Vvveb/commit/cbedd3754bccf8b7584f02ab301291f12e888b7e

text

-- Patch excerpt: admin/sql/mysqli/post_content_revision.sql
 		IN language_id INT,
 		IN created_at INT,
 		IN content INT,
+		IN admin INT,
 		IN start INT,
 		IN limit INT,
 		OUT fetch_all,
-- Source: https://github.com/givanz/Vvveb/commit/cbedd3754bccf8b7584f02ab301291f12e888b7e

The fix imports the Admin user helper and adds an admin parameter to the stored procedures, enabling ownership checks and enforcing the edit_other_posts capability before revision operations proceed.

Detection Methods for CVE-2026-49224

Indicators of Compromise

Backend requests to revision endpoints under admin/content/revisions referencing post_id values not authored by the requesting session.
Unexpected restore or delete actions against post revisions performed by non-privileged Author accounts.
Live post content silently reverting to a prior state without an entry from the owning Author in application logs.

Detection Strategies

Correlate the authenticated admin_id in web logs against the owner of the post_id referenced in revision requests, flagging mismatches.
Alert on any Author-role account issuing revision restore or delete calls, which should be rare in normal editorial workflows.
Review database change history for revision rows created, modified, or deleted outside the owning Author's session.

Monitoring Recommendations

Enable verbose access logging on the Vvveb admin controller and forward logs to a centralized analytics platform.
Baseline normal revision activity per Author and alert on deviations such as bulk reads across multiple post_id values.
Monitor for unauthorized changes to post_content_revision tables and the underlying stored procedures.

How to Mitigate CVE-2026-49224

Immediate Actions Required

Upgrade Vvveb to version 1.0.8.4 or later, which enforces the edit_other_posts capability on revision operations.
Audit existing Author accounts and revoke any that are unused or over-provisioned.
Review recent post content changes and revision deletions for signs of unauthorized restoration or tampering.

Patch Information

The fix is delivered in Vvveb 1.0.8.4. See the GitHub Release Tag 1.0.8.4, the GitHub Commit Update, and the GitHub Security Advisory GHSA-88w5-4x93-48rf for details. The patch adds an admin parameter to the revision stored procedures and applies an edit_other_posts capability check in the controller.

Workarounds

Restrict backend access to trusted administrators until the upgrade is applied, temporarily removing the Author role from untrusted users.
Place the Vvveb admin interface behind an authenticated reverse proxy or IP allowlist to limit exposure.
Increase database backup frequency for the post_content_revision table so unauthorized restores or deletions can be reversed.

bash

# Upgrade Vvveb to the patched release
cd /var/www/vvveb
git fetch --tags
git checkout 1.0.8.4
# Or download the release archive:
# wget https://github.com/givanz/Vvveb/archive/refs/tags/1.0.8.4.tar.gz