{"id":"CVE-2026-126375","aliases":["GHSA-387r-2vfq-vrmf"],"url":"https://o3.security/vulnerability/CVE-2026-126375","summary":"Vvveb through 1.0.8.6 Cross-Tenant Digital Asset Tampering via Media Trait","details":"Vvveb through 1.0.8.6 contains a missing authorization vulnerability that allows low-privilege vendors to rename, delete, or overwrite other vendors' digital-asset files in the shared storage/digital_assets directory. Attackers can send rename, delete, or upload requests to product/digital-asset with another vendor's filename to break downloads or substitute malicious content.","published":"2026-11-13T09:36:05.220Z","modified":"2026-11-14T02:47:28.176610533Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126375.json"},{"type":"ADVISORY","url":"https://github.com/givanz/Vvveb/security/advisories/GHSA-387r-2vfq-vrmf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126375"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/vvveb-through-1.0.8.6-cross-tenant-digital-asset-tampering-via-media-trait"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-11-14T02:47:28.176610533Z"}}