What is the CVSS score of CVE-2026-46408?

CVE-2026-46408 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Vvveb CMS are affected by CVE-2026-46408?

Vvveb CMS versions before 1.0.8.3 contain a cart hijacking vulnerability that allows authenticated users to access and manipulate other customers' shopping carts during checkout, creating direct risk…. A patch is available.

How to fix or mitigate CVE-2026-46408?

Within 24 hours: Identify all systems running Vvveb CMS and confirm installed versions against 1.0.8.3 baseline. Within 7 days: Upgrade all Vvveb CMS installations to version 1.0.8.3 or later; coordinate with development teams to test in non-production environments first. Within 30 days: Audit transaction logs from the past 90 days for unauthorized cart access patterns (cart_id mismatches between user sessions) and notify customers of any suspicious checkout activity.

Vvveb CMS CVE-2026-46408

EUVD-2026-30584 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-05-15 GitHub_M

Authentication Bypass Vvveb Givanz

7.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

May 15, 2026 - 20:02 EUVD

Analysis Generated

May 15, 2026 - 19:32 vuln.today

DescriptionGitHub Advisory

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, the checkout endpoint accepts a user-controlled cart_id and uses it to enter the payment flow without verifying cart ownership. A logged-in attacker can therefore reuse another user's cart data in their own checkout session. This vulnerability is fixed in 1.0.8.3.

AnalysisAI

Vvveb CMS versions before 1.0.8.3 allow authenticated users to hijack other users' shopping carts during checkout. The checkout endpoint fails to verify cart ownership when processing a user-supplied cart_id parameter, enabling attackers to access and potentially complete purchases using another user's cart contents. This vulnerability has been patched in version 1.0.8.3.

Technical ContextAI

Vvveb is a content management system with integrated ecommerce functionality and visual page builder capabilities. The vulnerability stems from improper authorization (CWE-639) in the checkout workflow, where the system accepts cart identifiers without verifying that the requesting user owns the referenced cart. This allows horizontal privilege escalation between authenticated users sharing the same application instance.

RemediationAI

Vendor-released patch: upgrade to Vvveb CMS version 1.0.8.3 or later, which implements proper cart ownership verification. The fix is available through the official Vvveb repository. As an interim mitigation for deployments unable to immediately upgrade, consider implementing additional session validation at the web application firewall level or temporarily disabling guest checkout functionality if it allows easier cart manipulation. Monitor checkout logs for anomalous cart_id usage patterns that may indicate exploitation attempts.