CVE-2026-49226: Vvveb CMS Auth Bypass Vulnerability

CVE-2026-49226 Overview

CVE-2026-49226 is an Insecure Direct Object Reference (IDOR) vulnerability in Vvveb, an open-source CMS with a page builder for websites, blogs, and ecommerce stores. Versions prior to 1.0.8.4 allow a low-privileged Author to access posts owned by other Authors through the backend post operations. The admin/controller/content/posts.php controller accepts a caller-supplied filter[admin_id] parameter that overrides the server-selected ownership restriction. It also accepts an attacker-controlled post_id for duplicate and delete actions, while admin/sql/sqlite/post.sql fails to enforce post.admin_id consistently. The issue is tracked as [CWE-639: Authorization Bypass Through User-Controlled Key].

Critical Impact
An authenticated low-privileged Author can view, duplicate, or delete posts owned by other Authors, exposing private drafts and causing content loss.

Affected Products

Vvveb CMS versions prior to 1.0.8.4
admin/controller/content/posts.php controller
admin/sql/sqlite/post.sql and admin/sql/mysqli/post.sql stored procedures

Discovery Timeline

2026-08-18 - CVE-2026-49226 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-49226

Vulnerability Analysis

The vulnerability originates in the Vvveb backend post-management flow. The posts.php controller determines which posts a user can act on by reading a filter[admin_id] value from the request. A low-privileged Author account can supply another Author's admin_id and enumerate their posts. The same controller accepts a caller-supplied post_id for duplicate and delete actions without verifying that the post belongs to the caller.

The backing SQL procedures in admin/sql/sqlite/post.sql do not consistently apply an admin_id predicate. As a result, ownership is not enforced at the data layer either. This creates a horizontal privilege escalation path across Author accounts.

Successful exploitation lets an attacker read post metadata, enumerate post_id values, duplicate posts, and delete posts along with related content. The consequences include disclosure of private drafts, content pollution, and data loss that disrupts editorial workflows.

Root Cause

The root cause is missing authorization enforcement on user-controlled identifiers [CWE-639]. The controller trusts client-supplied filter[admin_id] and post_id values, and the SQL layer does not re-check ownership. Authorization checks are absent for the list, read, approve, duplicate, and delete actions when the caller lacks the edit_other_posts capability.

Attack Vector

An attacker with a valid low-privileged Author session sends HTTP requests to the admin post endpoints while manipulating filter[admin_id] and post_id parameters. The attack requires only network access to the admin backend and low privileges, with no user interaction.

php

// Security patch in admin/controller/content/posts.php
				'post_id' => $post_id, 'type' => $this->type,
			] + $this->global;

			$editCapability = 'edit_other_posts';

			if (Admin::hasCapability($editCapability)) {
				unset($options['admin_id']);
			} else {
			}

			$result  = $this->posts->delete($options);

			if ($result && isset($result['post'])) {

Source: GitHub Commit 0ce6ba6

Detection Methods for CVE-2026-49226

Indicators of Compromise

Admin HTTP requests containing a filter[admin_id] parameter that does not match the authenticated user's admin_id.
Unexpected duplicate or delete actions on the posts controller referencing post_id values outside the caller's ownership.
Unexplained appearance or disappearance of posts, or duplicated drafts assigned to Author accounts.

Detection Strategies

Inspect web server access logs for admin POST requests to admin/controller/content/posts.php where the session's user identifier differs from the submitted admin_id.
Correlate database audit logs of DELETE and duplicate insert operations on the post table against the initiating Author account.
Alert on any Author-role session issuing high-volume enumeration requests to admin post endpoints.

Monitoring Recommendations

Enable application-level audit logging for all post list, read, duplicate, and delete actions with the invoking admin_id recorded.
Baseline typical Author behavior and flag deviations such as cross-owner post access or bulk deletions.
Retain admin panel request logs long enough to reconstruct any suspected IDOR sequence.

How to Mitigate CVE-2026-49226

Immediate Actions Required

Upgrade Vvveb to version 1.0.8.4 or later, which introduces the edit_other_posts capability check.
Audit existing Author accounts and remove any created or elevated during the exposure window.
Review the post table for unauthorized duplications or deletions since the vulnerable version was deployed.

Patch Information

The fix is available in Vvveb Release 1.0.8.4. The patch in GitHub Commit 0ce6ba6 adds an Admin::hasCapability('edit_other_posts') check to the list, read, approve, duplicate, and delete post actions. When the caller lacks the capability, the server-selected admin_id restriction is preserved. Refer to the GitHub Security Advisory GHSA-xxx7-8f3v-g9p6 for full details.

Workarounds

Restrict admin panel access to trusted network ranges using a reverse proxy or WAF rule until patching is complete.
Temporarily suspend low-privileged Author accounts on multi-author installations if immediate upgrade is not possible.
Deploy WAF rules that reject requests to admin/controller/content/posts.php containing a filter[admin_id] value that does not match the session identity.

bash

# Upgrade Vvveb to the patched release
git fetch --tags
git checkout 1.0.8.4
# Or download the release archive
curl -L -o vvveb-1.0.8.4.zip \
  https://github.com/givanz/Vvveb/archive/refs/tags/1.0.8.4.zip