{"id":"CVE-2026-49222","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-49222","summary":"Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product question operations allow a low-privileged…","details":"Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product question operations allow a low-privileged Vendor to manage questions under another Vendor's products. The admin/sql/sqlite/product_question.sql queries accept a caller-controlled product_question_id and do not verify product_question.product_id against product.admin_id for the current admin_id. An attacker can read pending question content and moderation data, change question status, edit question content, or delete questions, manipulating product Q&A visibility and integrity. This issue is fixed in version 1.0.8.4.","published":"2026-08-18T17:16:57.687","modified":"2026-08-18T17:16:57.687","cvss":{"score":7.6,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/givanz/Vvveb/commit/1f2b117c1460818c9306a78f22c12f0b713886df","label":"givanz/Vvveb@1f2b117"},"references":[{"type":"WEB","url":"https://github.com/givanz/Vvveb/commit/1f2b117c1460818c9306a78f22c12f0b713886df"},{"type":"WEB","url":"https://github.com/givanz/Vvveb/releases/tag/1.0.8.4"},{"type":"WEB","url":"https://github.com/givanz/Vvveb/security/advisories/GHSA-cjhq-xqq3-6xv8"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-08-18T17:16:57.687"}}