Description

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend comment operations allow a low-privileged Author to manage comments under another Author's posts. The admin/controller/content/comment.php and admin/controller/content/comments.php controllers and the admin/sql/sqlite/comment.sql queries accept a caller-controlled comment_id without verifying comment.post_id against post.admin_id for the current admin_id. An attacker can read pending comment content and commenter email addresses, change moderation status, edit comment content, or delete comments, breaking author and moderation boundaries. This issue is fixed in version 1.0.8.4.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-08-18T16:17:13.653Z",
  "pubdate": "2026-08-18T16:17:13.653Z",
  "executiveSummary": "An authorization bypass vulnerability exists in Vvveb prior to version 1.0.8.4 within the backend comment management operations. The vulnerability stems from a failure to properly validate ownership constraints between comment records and post authors during administrative operations.\nSpecifically, low-privileged users with Author roles can interact with and modify comment records belonging to posts authored by other users. This architectural flaw permits unauthorized cross-author data access and modification, violating foundational multi-tenant and role-based access control boundaries within the CMS.\nThe risk implications include unauthorized disclosure of sensitive user data, such as commenter email addresses and pending comment content, as well as unauthorized state modifications including comment content tampering, moderation status alteration, and arbitrary comment deletion.\nExploitation of this vulnerability requires authenticated access with low-privileged Author capabilities. Attackers leverage caller-controlled input parameters to interact with backend controllers without verifying that the targeted comment's post_id correlates to the authenticated admin_id.\nThe issue is fully resolved in Vvveb version 1.0.8.4 through proper implementation of server-side authorization checks ensuring that comment operations enforce strict relationship validations against post ownership.",
  "technicalDetails": "The vulnerability resides in the backend comment management controllers and database query execution layers of Vvveb, specifically within admin/controller/content/comment.php, admin/controller/content/comments.php, and the underlying database logic located at admin/sql/sqlite/comment.sql.\nThe root cause of the vulnerability is an insecure direct object reference (IDOR) coupled with a missing access control check. When administrative comment operations are invoked, the backend logic accepts a caller-controlled comment_id parameter via HTTP requests. However, the application fails to perform a relational integrity check confirming that the requested comment.post_id securely belongs to the post.admin_id associated with the currently authenticated session's admin_id.\nAuthentication and privilege requirements dictate that the attacker must possess an authenticated low-privileged Author account within the Vvveb backend. Because the application exposes comment management endpoints to this role without contextual resource ownership validation, an authenticated attacker can arbitrarily manipulate comment identifiers.\nThe attack flow proceeds as follows: 1) An authenticated low-privileged Author authenticates to the Vvveb backend interface. 2) The attacker crafts or intercepts HTTP requests directed toward comment management endpoints, such as those handled by admin/controller/content/comment.php. 3) The attacker modifies the comment_id parameter to reference records associated with posts owned by different authors or administrators. 4) The backend application processes the request via database queries defined in admin/sql/sqlite/comment.sql without verifying the administrative ownership mapping. 5) The server executes the requested action, granting the attacker the ability to read pending comment contents and commenter email addresses, alter moderation statuses, edit comment text, or purge the comments entirely.\nThe post-exploitation impact compromises the confidentiality and integrity of user communications and content management operations. Authors can subvert access boundaries, read private commenter metadata, and disrupt moderation workflows across the entire platform. The affected software versions comprise all Vvveb installations prior to version 1.0.8.4."
}