Description

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product revision operations allow a low-privileged Vendor to access revisions for products owned by another Vendor. The admin/controller/product/revisions.php route reuses admin/controller/content/revisions.php, while admin/sql/sqlite/product_content_revision.sql trusts caller-controlled product_id, language_id, and created_at values without applying the current admin_id to revision reads, restores, and deletes. An attacker can read historic product content, restore a revision over another Vendor's live product content, or delete revision records, exposing private copy, corrupting product pages, and removing audit history. This issue is fixed in version 1.0.8.4.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-08-18T17:16:58.117Z",
  "pubdate": "2026-08-18T17:16:58.117Z",
  "executiveSummary": "An Insecure Direct Object Reference (IDOR) vulnerability exists in Vvveb prior to version 1.0.8.4 within the backend product revision operations.\nThe vulnerability allows a low-privileged Vendor to access, read, restore, and delete product revisions owned by other Vendors.\nThe impact includes the exposure of private copy, the corruption of live product content belonging to other users, and the removal of critical audit history.\nThe affected product is Vvveb prior to version 1.0.8.4.\nRisk implications are high for multi-vendor environments, as data confidentiality, integrity, and non-repudiation controls are entirely bypassed.\nThe attacker capabilities are limited to authenticated low-privileged Vendor accounts.\nExploitation requires the ability to supply caller-controlled identifiers such as product_id, language_id, and created_at values to backend controller routes without validating ownership against the current admin_id.",
  "technicalDetails": "The root cause of the vulnerability stems from improper authorization checks and a lack of tenant isolation within the backend product revision handling logic.\nSpecifically, the admin/controller/product/revisions.php route improperly reuses the admin/controller/content/revisions.php logic.\nBeneath this, the underlying database query file admin/sql/sqlite/product_content_revision.sql blindly trusts caller-controlled parameters including product_id, language_id, and created_at values.\nThe application fails to apply the current session's admin_id as a mandatory constraint or ownership filter during revision read, restore, and delete operations.\nThe vulnerable component consists of the product revision controller routes and the associated SQL query definitions in Vvveb prior to version 1.0.8.4.\nAuthentication requirements dictate that the attacker must possess a valid, authenticated low-privileged Vendor account.\nPrivilege requirements are minimal, requiring only standard Vendor access rather than administrative privileges.\nNetwork exposure is restricted to the backend administration interface of the Vvveb CMS.\nThe exploitation method relies on manipulating request parameters associated with product revisions to reference objects belonging to foreign vendors.\nThe step-by-step attack flow proceeds as follows: First, the authenticated low-privileged Vendor initiates a request to the product revision endpoint. Second, the attacker supplies arbitrary or enumerated product_id, language_id, and created_at parameters corresponding to another Vendor's product revisions. Third, the controller processes the request via admin/controller/product/revisions.php without verifying whether the targeted product_id belongs to the requesting admin_id. Fourth, the database query executes via admin/sql/sqlite/product_content_revision.sql without tenancy constraints. Finally, the application returns private historic product data, executes a content restoration overwriting live production pages, or deletes the target revision records entirely.\nPost-exploitation impact encompasses unauthorized data disclosure of proprietary copy, unauthorized modification and corruption of live e-commerce listings, and destruction of audit trails."
}