CVE-2026-49224

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post revision operations allow a low-privileged Author to access revisions for posts owned by another Author. The admin/controller/content/revisions.php controller and admin/sql/sqlite/post_content_revision.sql queries trust caller-controlled post_id, language_id, and created_at values without consistently applying the current admin_id to revision lists, reads, restores, and deletes. An attacker can read historic post content, restore a revision over another Author's live post content, or delete revision records, exposing drafts, corrupting published content, and removing audit history. This issue is fixed in version 1.0.8.4.

• CWE-639

• https://github.com/givanz/Vvveb/commit/cbedd3754bccf8b7584f02ab301291f12e888b7e
• https://github.com/givanz/Vvveb/releases/tag/1.0.8.4
• https://github.com/givanz/Vvveb/security/advisories/GHSA-88w5-4x93-48rf
• https://github.com/givanz/Vvveb/security/advisories/GHSA-88w5-4x93-48rf

Published

Aug 18, 2026

Last Modified

Sep 8, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49219ImageMagick is free and open-source software used for editin…5.5
• CVE-2026-4922GitLab has remediated an issue in GitLab CE/EE affecting all…8.1
• CVE-2026-49220Jellyfin is an open source self hosted media server. Prior t…5.7
• CVE-2026-49221Vvveb is a powerful and easy to use CMS with page builder to…8.8
• CVE-2026-49222Vvveb is a powerful and easy to use CMS with page builder to…7.6
• CVE-2026-49223Vvveb is a powerful and easy to use CMS with page builder to…7.6
• CVE-2026-49225Vvveb is a powerful and easy to use CMS with page builder to…8.3
• CVE-2026-49226Vvveb is a powerful and easy to use CMS with page builder to…8.3
• CVE-2026-49227Vvveb is a powerful and easy to use CMS with page builder to…7.6
• CVE-2026-49228Vvveb is a powerful and easy to use CMS with page builder to…8.8
• CVE-2026-49229Actual is a local-first personal finance app. Prior to 26.6.…8.3
• CVE-2026-4923Impact: When using multiple wildcards, combined with at lea…5.9