{"apiVersion":"1.0","identifier":"CVE-2026-49225","description":"Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product revision operations allow a low-privileged Vendor to access revisions for products owned by another Vendor. The admin/controller/product/revisions.php route reuses admin/controller/content/revisions.php, while admin/sql/sqlite/product_content_revision.sql trusts caller-controlled product_id, language_id, and created_at values without applying the current admin_id to revision reads, restores, and deletes. An attacker can read historic product content, restore a revision over another Vendor-s live product content, or delete revision records, exposing private copy, corrupting product pages, and removing audit history. This issue is fixed in version 1.0.8.4.","publishedAt":"2026-08-18T17:16:58","lastModifiedAt":"2026-08-18T18:17:47","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-49225","cvssScore":8.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","epssProbability":0.00424,"riskScore":0.86,"affectedProduct":"Vvveb","affectedVersions":"<1.0.8.4","vulnerabilityType":"Web app","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-49225","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-49225","en":"https://www.redsauce.net/en/cves/CVE-2026-49225","fr":"https://www.redsauce.net/fr/cves/CVE-2026-49225","pt":"https://www.redsauce.net/pt/cves/CVE-2026-49225","de":"https://www.redsauce.net/de/cves/CVE-2026-49225","sk":"https://www.redsauce.net/sk/cves/CVE-2026-49225","el":"https://www.redsauce.net/el/cves/CVE-2026-49225"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-49225"}}