{"id":"CVE-2026-126373","kind":"vulnerability","aliases":["CVE-2026-126373"],"related":[],"title":"Vvveb CMS: low-privilege authors can read other authors' draft revisions","description":"Vvveb 1.0.8.4 through 1.0.8.6 contains an authorization bypass vulnerability in the content/revisions revision action that lets low-privileged Authors read other authors' revisions. Attackers can supply a post_id, language_id, and created_at timestamp to retrieve private unpublished drafts, because the revision() action lacks the admin_id ownership restriction.","summary":"Vvveb 1.0.8.4 through 1.0.8.6 has an authorization bypass in the content/revisions action, which lacks an ownership check. An authenticated low-privileged author can supply a post_id, language_id and created_at timestamp to read other authors' unpublished drafts.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cms","other","self-hosted","vvveb"],"not_affected_if":["admin-only-users","other-versions"],"how_to_check":"- Check the installed Vvveb version and whether it falls in `1.0.8.4` through `1.0.8.6`\n- Review access to the content/revisions action for non-admin author accounts","fix":null,"status":"open","published_at":"2026-11-13T10:17:39+00:00","first_seen_at":"2026-11-13T10:47:17+00:00","triaged_at":"2026-11-13T10:57:22+00:00","updated_at":"2026-11-13T10:57:22+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-13T10:57:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Vvveb CMS: low-privilege authors can read other authors' draft revisions","impact":"low","summary":"Vvveb 1.0.8.4 through 1.0.8.6 has an authorization bypass in the content/revisions action, which lacks an ownership check. An authenticated low-privileged author can supply a post_id, language_id and created_at timestamp to read other authors' unpublished drafts.","audience":"businesses","category":"other","nicknames":[],"who_cares":["vvveb","cms","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authors read other authors' unpublished draft content","analyst_note":"Confirm the fixed version and any patch from the vendor advisory at github.com and the VulnCheck advisory before stating a fix.","how_to_check":"- Check the installed Vvveb version and whether it falls in `1.0.8.4` through `1.0.8.6`\n- Review access to the content/revisions action for non-admin author accounts\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["admin-only-users","other-versions"],"who_is_affected":"Sites running Vvveb 1.0.8.4 through 1.0.8.6 that have author accounts with lower privileges than admins. The exposure is reading private unpublished drafts belonging to other authors. Sites on other versions, or with only admin users, are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000736,"input_tokens":4630,"output_tokens":546,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126373':15A,18A '-2026':14A,17A '1.0.8.4':26B,66C '1.0.8.6':28B,68C 'action':36B,78C,109C 'admin':112C 'attack':89C 'authent':43B 'author':6A,10A,31B,47B,62B,71C,84C,87C 'bypass':32B,72C 'check':41B 'cms':2A,19B 'contain':69C 'content/revisions':35B,76C 'creat':56B,98C 'cve':13A,16A 'draft':11A,64B,105C 'host':23B 'id':52B,54B,94C,96C,113C 'lack':38B,110C 'languag':53B,95C 'let':80C 'low':4A,45B,82C 'low-privileg':3A,44B,81C 'ownership':40B,114C 'post':51B,93C 'privat':103C 'privileg':5A,46B,83C 'read':8A,60B,85C 'restrict':115C 'retriev':102C 'revis':12A,77C,88C,108C 'self':22B 'self-host':21B 'suppli':49B,91C 'timestamp':58B,100C 'unpublish':63B,104C 'vulner':73C 'vvveb':1A,24B,25B,65C","nicknames":[],"mitigations":[],"who_affected":"Sites running Vvveb 1.0.8.4 through 1.0.8.6 that have author accounts with lower privileges than admins. The exposure is reading private unpublished drafts belonging to other authors. Sites on other versions, or with only admin users, are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cms","medium","other","selfhosted","vvveb"],"campaign_type":null,"search_a":"'-126373':15A,18A '-2026':14A,17A 'author':6A,10A 'cms':2A 'cve':13A,16A 'draft':11A 'low':4A 'low-privileg':3A 'privileg':5A 'read':8A 'revis':12A 'vvveb':1A","search_b":"'1.0.8.4':26B '1.0.8.6':28B 'action':36B 'authent':43B 'author':31B,47B,62B 'bypass':32B 'check':41B 'cms':19B 'content/revisions':35B 'creat':56B 'draft':64B 'host':23B 'id':52B,54B 'lack':38B 'languag':53B 'low':45B 'low-privileg':44B 'ownership':40B 'post':51B 'privileg':46B 'read':60B 'self':22B 'self-host':21B 'suppli':49B 'timestamp':58B 'unpublish':63B 'vvveb':24B,25B","search_c":"'1.0.8.4':66C '1.0.8.6':68C 'action':78C,109C 'admin':112C 'attack':89C 'author':71C,84C,87C 'bypass':72C 'contain':69C 'content/revisions':76C 'creat':98C 'draft':105C 'id':94C,96C,113C 'lack':110C 'languag':95C 'let':80C 'low':82C 'low-privileg':81C 'ownership':114C 'post':93C 'privat':103C 'privileg':83C 'read':85C 'restrict':115C 'retriev':102C 'revis':77C,88C,108C 'suppli':91C 'timestamp':100C 'unpublish':104C 'vulner':73C 'vvveb':65C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-29T01:15:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126373","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126373","severity":null,"published_at":"2026-11-13T10:17:39+00:00","modified_at":"2026-11-13T10:17:39+00:00","first_seen_at":"2026-11-13T10:47:17+00:00","fetched_at":"2026-11-13T10:47:17+00:00","note":null}],"documents":[{"id":144987,"url":"https://github.com/givanz/Vvveb/security/advisories/GHSA-7fg6-jfgq-56q9","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-29T01:15:52+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144988,"url":"https://www.vulncheck.com/advisories/vvveb-1.0.8.4-through-1.0.8.6-authorization-bypass-via-post-revisions","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}