CMS Vulnerability in Vvveb Allows Unauthorized Access to Product Revisions
CVE-2026-49225

8.3HIGH

Key Information:

Vendor

Givanz

Status
Vvveb
Vendor
CVE Published:
18 August 2026

What is CVE-2026-49225?

The Vvveb CMS contains a vulnerability that permits low-privileged vendors to access product revisions belonging to other vendors. This occurs due to the insecure handling of admin IDs in the backend product revision operations, allowing unauthorized users to read historic product content, restore other vendors' revisions over live product content, or delete revision records entirely. Consequently, this can lead to exposure of private information, corruption of product pages, and loss of audit history. The issue has been resolved in version 1.0.8.4.

Affected Version(s)

Vvveb < 1.0.8.4

References

https://github.com/givanz/Vvveb/security/advisories/GHSA-...
x_refsource_CONFIRM
https://github.com/givanz/Vvveb/commit/e7413a29dcf1ccd04b...
x_refsource_MISC
https://github.com/givanz/Vvveb/releases/tag/1.0.8.4
x_refsource_MISC

CVSS V3.1

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.