CyberRota Analysis
AI-GeneratedVvveb CMS versions prior to 1.0.8.4 are vulnerable, allowing low-privileged users to access, duplicate, or delete posts owned by other authors due to inadequate enforcement of access controls in the backend. This vulnerability can lead to exposure of private drafts, content pollution, and potential data loss, posing a significant risk to content integrity and business operations. Organizations using Vvveb should prioritize upgrading to the latest version to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post operations allow a low-privileged Author to access posts owned by another Author. The admin/controller/content/posts.php controller permits filter[admin_id] to replace the server-selected admin_id restriction and accepts a caller-controlled post_id for duplicate and delete actions, while admin/sql/sqlite/post.sql does not consistently enforce post.admin_id. An attacker can view post metadata, discover post identifiers, duplicate posts, or delete posts and related content, exposing private drafts and causing content pollution, data loss, or business disruption. This issue is fixed in version 1.0.8.4.