CVE-2026-46408

{
  "id": "CVE-2026-46408",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-15T19:17:04.460",
  "lastModified": "2026-10-26T00:10:00.150",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, the checkout endpoint accepts a user-controlled cart_id and uses it to enter the payment flow without verifying cart ownership. A logged-in attacker can therefore reuse another user's cart data in their own checkout session. This vulnerability is fixed in 1.0.8.3."
    },
    {
      "lang": "es",
      "value": "Vvveb es un CMS potente y fácil de usar con un constructor de páginas para crear sitios web, blogs o tiendas de comercio electrónico. Antes de la versión 1.0.8.3, el endpoint de pago acepta un cart_id controlado por el usuario y lo utiliza para entrar en el flujo de pago sin verificar la propiedad del carrito. Un atacante autenticado puede, por lo tanto, reutilizar los datos del carrito de otro usuario en su propia sesión de pago. Esta vulnerabilidad está corregida en la versión 1.0.8.3."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "givanz",
          "product": "Vvveb",
          "versions": [
            {
              "version": "< 1.0.8.3",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
          "baseScore": 7.6,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-15T19:52:41.934191Z",
          "id": "CVE-2026-46408",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-rmh2-wv73-xpqh",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-rmh2-wv73-xpqh",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}