Description

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post operations allow a low-privileged Author to access posts owned by another Author. The admin/controller/content/posts.php controller permits filter[admin_id] to replace the server-selected admin_id restriction and accepts a caller-controlled post_id for duplicate and delete actions, while admin/sql/sqlite/post.sql does not consistently enforce post.admin_id. An attacker can view post metadata, discover post identifiers, duplicate posts, or delete posts and related content, exposing private drafts and causing content pollution, data loss, or business disruption. This issue is fixed in version 1.0.8.4.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-08-18T16:17:13.510Z",
  "pubdate": "2026-08-18T16:17:13.510Z",
  "executiveSummary": "An improper authorization vulnerability exists in Vvveb prior to version 1.0.8.4, specifically within the backend post operations.\nThe vulnerability allows a low-privileged Author user to bypass intended access controls and interact with posts owned by other authors.\nThe flaw stems from insecure handling of input parameters within the administration controllers and SQL queries, enabling unauthorized data access and manipulation.\nAn authenticated attacker with low privileges can exploit this vulnerability to view sensitive post metadata, discover arbitrary post identifiers, duplicate unauthorized posts, or execute delete actions against posts and their associated content.\nThe impact includes the exposure of private drafts, content pollution, unintended data loss, and potential business disruption.\nSuccessful exploitation requires low-privileged author authentication and backend access, but does not necessitate complex interaction beyond manipulating HTTP request parameters.",
  "technicalDetails": "The root cause of the vulnerability resides in insufficient authorization checks and improper parameter handling within the backend controllers and database abstraction layers of Vvveb.\nSpecifically, the admin/controller/content/posts.php controller insecurely permits the filter[admin_id] parameter to override the server-selected admin_id restriction.\nAdditionally, the same controller accepts caller-controlled post_id parameters for duplicate and delete actions without validating whether the authenticated user owns the target post.\nSimultaneously, the underlying database query definitions in admin/sql/sqlite/post.sql fail to consistently enforce post.admin_id constraints during execution.\nThe affected component involves the backend post management logic, specifically processing requests in admin/controller/content/posts.php and executing queries defined in admin/sql/sqlite/post.sql.\nThe affected versions include all Vvveb installations prior to version 1.0.8.4.\nAuthentication is required to exploit this vulnerability, specifically utilizing a low-privileged Author account with access to backend post operations.\nPrivilege requirements are minimal, limited to the Author role, which should normally be restricted to managing only their own content.\nThe attack flow proceeds as follows: First, an authenticated attacker with Author privileges navigates to the backend post management interface. Second, the attacker issues HTTP requests targeting admin/controller/content/posts.php while manipulating the filter[admin_id] parameter to bypass server-side ownership boundaries. Third, the attacker supplies arbitrary post_id values corresponding to posts owned by other users. Fourth, the insecure controller and underlying SQL queries in admin/sql/sqlite/post.sql process the request without proper authorization validation. Finally, the application executes duplicate or delete operations or returns post metadata belonging to other authors.\nPost-exploitation impact includes unauthorized viewing of private drafts, data tampering through unauthorized duplication, and permanent data loss via malicious deletion of posts and related content."
}