Description

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product operations allow a low-privileged Vendor to access products owned by another Vendor. The admin/controller/product/products.php controller accepts a caller-controlled product_id for duplicate and delete actions, and admin/sql/sqlite/product.sql loads and mutates products without consistently applying the current admin_id when view_other_products or edit_other_products is absent. An attacker can read product details, duplicate products, or delete products and related catalog data, exposing commercial information and causing unauthorized copies, catalog pollution, data loss, or business disruption. This issue is fixed in version 1.0.8.4.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-18T17:16:58.263Z",
  "pubdate": "2026-08-18T17:16:58.263Z",
  "executiveSummary": "An Insecure Direct Object Reference (IDOR) vulnerability exists in Vvveb prior to version 1.0.8.4 within the backend product operations.\nThe vulnerability allows a low-privileged Vendor to access, duplicate, and delete products owned by other Vendors.\nThe affected product is Vvveb, specifically impacting versions prior to 1.0.8.4.\nThe risk implications include the exposure of sensitive commercial information, catalog pollution, unauthorized duplication of products, data loss, and overall business disruption.\nAn attacker requires low-privileged Vendor access to the backend system to exploit this flaw.\nThe issue stems from a failure to consistently enforce permission checks and apply the current admin_id context during database operations.",
  "technicalDetails": "The root cause of the vulnerability lies in inadequate authorization checks and missing multi-tenancy isolation within backend product management controllers and database queries in Vvveb.\nThe vulnerable component is located in the admin/controller/product/products.php controller and the database interaction logic defined in admin/sql/sqlite/product.sql.\nThe admin/controller/product/products.php controller accepts caller-controlled product_id parameters for actions such as duplicate and delete.\nSimultaneously, the SQL layer in admin/sql/sqlite/product.sql loads and mutates product records without consistently verifying or applying the current admin_id when the capabilities view_other_products or edit_other_products are absent.\nAuthentication and privilege requirements involve an authenticated user holding a low-privileged Vendor role within the Vvveb backend.\nThe attack flow proceeds as follows: 1) An authenticated low-privileged Vendor initiates a product duplication or deletion request via the backend interface; 2) The attacker supplies an arbitrary product_id belonging to a different Vendor within the request parameters; 3) The admin/controller/product/products.php controller processes the request without validating object ownership against the session's admin_id; 4) The underlying database queries in admin/sql/sqlite/product.sql execute the mutation or retrieval against the foreign product record due to the absence of strict authorization filtering.\nPost-exploitation impact includes unauthorized reading of proprietary product details, generation of unauthorized product copies leading to catalog pollution, deletion of critical catalog data causing irreversible data loss, and significant business disruption for affected vendors on the platform.\nThe vulnerability is resolved in Vvveb version 1.0.8.4 by enforcing proper access controls and scope verification based on the current admin_id during product operations."
}