CVE-2026-126376 · Package
NO FIX YET
Vvveb 1.0.8.4 through 1.0.8.6 has an incomplete authorization fix that lets authors and vendors bypass owner scoping on admin_id. An attacker with a low-privilege account can list other users' drafts, duplicate posts or products, and enumerate every vendor's digital-asset metadata.
first public Oct 29, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running Vvveb 1.0.8.4 through 1.0.8.6 where authors or vendors hold accounts. The flaw is in the admin_id filter on record listing and duplication; instances without author or vendor accounts face less exposure. Sources do not state a fixed version or a configuration that removes the issue.
Not affected if no-author-or-vendor-accounts
Who cares cms, self-hosted, vvveb
unknown if the sources do not say where it is shown.No fix yet, per the sources.
Vvveb 1.0.8.4 through 1.0.8.6 contains an incomplete authorization fix that allows low-privilege authors and vendors to access other users' records by bypassing admin_id owner scoping. Attackers can supply filter[admin_id] to list drafts, invoke duplicate() on posts or products, or enumerate every vendor's digital-asset metadata.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.