CVE-2026-126373 · Other
NO FIX YET
Vvveb 1.0.8.4 through 1.0.8.6 has an authorization bypass in the content/revisions action, which lacks an ownership check. An authenticated low-privileged author can supply a post_id, language_id and created_at timestamp to read other authors' unpublished drafts.
first public Oct 29, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running Vvveb 1.0.8.4 through 1.0.8.6 that have author accounts with lower privileges than admins. The exposure is reading private unpublished drafts belonging to other authors. Sites on other versions, or with only admin users, are less exposed.
Not affected if admin-only-users, other-versions
Who cares cms, self-hosted, vvveb
1.0.8.4 through 1.0.8.6No fix yet, per the sources.
Vvveb 1.0.8.4 through 1.0.8.6 contains an authorization bypass vulnerability in the content/revisions revision action that lets low-privileged Authors read other authors' revisions. Attackers can supply a post_id, language_id, and created_at timestamp to retrieve private unpublished drafts, because the revision() action lacks the admin_id ownership restriction.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.