Vvveb CMS CVE-2026-49221

Exploitation requires a valid Vendor-role account (low-privilege authenticated session, PR:L per CVSS) on a Vvveb installation running any version prior to 1.0.8.4. The vulnerability is only impactful in multi-vendor deployments where multiple Vendor accounts coexist and tenant isolation is expected - a single-vendor instance has no cross-boundary assets to access. The attacker must reach the Vvveb admin panel over the network (AV:N), and no special non-default configuration is needed beyond the existence of more than one Vendor account. Limiting factors: exploitation is restricted to users who can obtain Vendor credentials (insider threat or credential compromise), and anonymous external attackers without a valid session are not directly affected.

The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects that a Vendor account reachable over the network can achieve high-impact outcomes across all three CIA dimensions with no interaction or complexity required. Real-world risk is significant exclusively in multi-vendor deployments - a single-vendor installation has no cross-tenant boundary to violate, sharply reducing effective blast radius. No EPSS data was provided and no CISA KEV listing is present, so exploitation probability is inferred from CVSS metrics and vulnerability class alone rather than observed threat activity. The combination of low attack complexity, low privilege requirement, and full-triad impact justifies treating this as a high priority for any multi-vendor Vvveb operator. Additionally, code analysis of the commit diff reveals that the index() function in digital-assets.php contains an unconditional $this->adminFilter = false; statement after the capability check, which may neutralize the ownership filter for asset listing operations even after patching - operators should verify fix effectiveness before assuming full remediation.

An authenticated Vendor on a shared Vvveb marketplace iterates digital_asset_id integers in HTTP requests to the /admin/product/digital-assets endpoint, enumerating asset names and file metadata across all other Vendors without triggering any authorization error. The same technique applied to the delete endpoint permanently removes a competitor's asset records, breaking their product listings, with no public exploit code required given the straightforward IDOR pattern.