What is the CVSS score of CVE-2026-44826?

CVE-2026-44826 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Vvveb CMS are affected by CVE-2026-44826?

Vvveb CMS versions before 1.0.8.2 contain a critical flaw allowing attackers to manipulate order quantities to negative values, enabling fraudulent transactions where merchants owe money to customers…. A patch is available.

How to fix or mitigate CVE-2026-44826?

Within 24 hours: Identify all Vvveb CMS instances and verify current version numbers; immediately restrict access to cart endpoints via WAF rules if available. Within 7 days: Upgrade all instances to Vvveb CMS version 1.0.8.2 or later; implement input validation blocking negative quantity submissions at the application layer. Within 30 days: Conduct forensic audit of order history for the past 90 days to detect and remediate fraudulent transactions; establish monitoring alerts for quantity values below zero.

Vvveb CMS CVE-2026-44826

EUVD-2026-30580 HIGH

Improper Validation of Specified Quantity in Input (CWE-1284)

2026-05-15 GitHub_M

Information Disclosure Vvveb Givanz

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

May 15, 2026 - 20:02 EUVD

Analysis Generated

May 15, 2026 - 19:32 vuln.today

DescriptionGitHub Advisory

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.2, Vvveb CMS does not validate the sign of the quantity parameter on the cart-add endpoint. Submitting a negative integer is accepted by the server and treated as a normal positive line-item, but with the sign carried through into every downstream computation: line total, sub-total, taxes, and grand total all become negative numbers. The customer-facing cart UI then displays a negative grand total to the user, the checkout flow accepts the negative cart, and the resulting order is persisted in the merchant's database with a negative total column. From the merchant's order management dashboard, this surfaces as a real order with a negative total - an "the merchant owes the customer money" record that no legitimate workflow ever creates. This vulnerability is fixed in 1.0.8.2.

AnalysisAI

Negative quantity manipulation in Vvveb CMS versions before 1.0.8.2 allows unauthenticated remote attackers to create orders with negative totals, potentially defrauding merchants. The cart-add endpoint accepts negative quantity values that propagate through the entire order flow, creating legitimate-looking orders where the merchant appears to owe money to the customer. Fixed in version 1.0.8.2.

Technical ContextAI

Vvveb is a CMS platform with built-in ecommerce functionality for creating online stores. The vulnerability stems from missing input validation on the quantity parameter in the shopping cart API endpoint. This is classified as CWE-1284 (Improper Validation of Specified Quantity in Input), where the application fails to enforce that quantity values must be positive integers. The negative values are treated as valid throughout the order processing pipeline, affecting line items, subtotals, taxes, and final totals.

RemediationAI

Upgrade Vvveb CMS to version 1.0.8.2 or later, which includes the fix for this vulnerability. The patch is available through the official Vvveb repository as referenced in GitHub advisory GHSA-75x2-j47j-mg8j. As an immediate workaround, implement server-side validation to reject any cart-add requests with non-positive quantity values, though this requires custom code modifications. Additionally, review existing orders for any entries with negative totals and implement business process controls to flag suspicious orders before payment processing.