Description

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operations allow a low-privileged Vendor to manage reviews under another Vendor's products. The admin/sql/sqlite/product_review.sql queries accept a caller-controlled product_review_id and do not verify product_review.product_id against product.admin_id for the current admin_id. An attacker can read pending review content, ratings, author information, and moderation state, change review status, edit review content, or delete reviews, manipulating product review visibility and integrity. This issue is fixed in version 1.0.8.4.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-08-18T17:16:57.830Z",
  "pubdate": "2026-08-18T17:16:57.830Z",
  "executiveSummary": "An Insecure Direct Object Reference (IDOR) vulnerability exists in the backend product review operations of Vvveb prior to version 1.0.8.4.\nThe vulnerability allows a low-privileged Vendor to manipulate product reviews belonging to other Vendors.\nThe affected component involves SQL queries handled via admin/sql/sqlite/product_review.sql, which accept a caller-controlled product_review_id without verifying the ownership relationship between product_review.product_id and the current admin_id.\nAn authenticated attacker with low privileges (Vendor role) can exploit this flaw to read pending review content, ratings, author information, and moderation states, as well as unauthorizedly modify review statuses, edit review content, or delete reviews entirely.\nThis impacts the integrity, confidentiality, and availability of review data across different vendor accounts within the e-commerce CMS.\nSuccessful exploitation requires low-privileged authentication as a Vendor and the ability to interact with backend product review endpoints.",
  "technicalDetails": "The root cause of the vulnerability is an authorization bypass stemming from missing server-side access controls and missing relational validation within backend database operations.\nSpecifically, the vulnerable component resides in admin/sql/sqlite/product_review.sql, where SQL queries process caller-controlled product_review_id parameters directly.\nThe application fails to perform a referential integrity or ownership check to verify whether the target product_review.product_id maps to the product.admin_id associated with the currently authenticated admin_id session.\nPrivilege requirements are limited to low-privileged users assigned the Vendor role, allowing them access to backend management functionality.\nBecause the system trusts the incoming product_review_id without validating multi-tenant boundaries or role-based ownership, an attacker authenticated as a Vendor can craft arbitrary requests targeting reviews outside their designated scope.\nThe attack flow proceeds as follows: 1) The malicious Vendor authenticates to the Vvveb backend. 2) The attacker intercepts or constructs requests to product review management endpoints referencing a product_review_id belonging to a different Vendor's product. 3) The backend executes the queries defined in admin/sql/sqlite/product_review.sql using the supplied identifier without scoping the query against the current admin_id. 4) The database processes the statement, returning sensitive review records or executing state-changing operations such as updates and deletions.\nPost-exploitation impact includes the unauthorized exposure of sensitive customer feedback, manipulation of product ratings and visibility, tampering with moderation workflows, and data destruction through review deletion.\nThe vulnerability affects all Vvveb versions prior to 1.0.8.4 and is resolved in version 1.0.8.4 through the implementation of proper authorization checks."
}