CVE-2026-49223

{
  "id": "CVE-2026-49223",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-18T17:16:57.830",
  "lastModified": "2026-10-22T22:10:00.250",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operations allow a low-privileged Vendor to manage reviews under another Vendor's products. The admin/sql/sqlite/product_review.sql queries accept a caller-controlled product_review_id and do not verify product_review.product_id against product.admin_id for the current admin_id. An attacker can read pending review content, ratings, author information, and moderation state, change review status, edit review content, or delete reviews, manipulating product review visibility and integrity. This issue is fixed in version 1.0.8.4."
    },
    {
      "lang": "es",
      "value": "Vvveb es un potente y fácil de usar CMS con constructor de páginas para construir sitios web, blogs o tiendas de comercio electrónico. Anteriormente a la 1.0.8.4, las operaciones de revisión de productos del backend de Vvveb permiten a un Vendedor con pocos privilegios gestionar reseñas de productos de otro Vendedor. Las consultas admin/sql/sqlite/product_review.sql aceptan un product_review_id controlado por el llamador y no verifican product_review.product_id contra product.admin_id para el admin_id actual. Un atacante puede leer el contenido de reseñas pendientes, calificaciones, información del autor y el estado de moderación, cambiar el estado de la reseña, editar el contenido de la reseña o eliminar reseñas, manipulando la visibilidad y la integridad de las reseñas de productos. Este problema está solucionado en la versión 1.0.8.4."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "givanz",
          "product": "Vvveb",
          "versions": [
            {
              "version": "< 1.0.8.4",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
          "baseScore": 7.6,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-18T19:08:11.438646Z",
          "id": "CVE-2026-49223",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/givanz/Vvveb/commit/3d5c15dcf4b50e4580161f05cb9e643d834d044a",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.4",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-cj37-c5m2-3jmc",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-cj37-c5m2-3jmc",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}