Vvveb CMS CVE-2026-49224

Exploitation requires a valid Author-level (or equivalent low-privilege) authenticated account on the target Vvveb CMS installation. The CVSS vector PR:L confirms this authentication prerequisite. The vulnerable condition exists in default multi-author deployments - no non-default configuration is required beyond having more than one author account registered. Exploitation is limited to the revision management feature and requires knowledge of or ability to enumerate target post_id values, which are typically sequential integers. There is no user interaction required from the victim. Single-author deployments have no practical exposure from this vulnerability since there are no other authors' revisions to access.

The CVSS 8.3 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) is well-calibrated for this vulnerability. Attack complexity is genuinely low - any Author account is sufficient, no additional configuration is required, and the exploit is as simple as substituting a different post_id in a revision API request. The integrity impact rated H is the most consequential aspect: an attacker can silently restore a stale or adversary-crafted revision over another author's currently-published post, corrupting live content without triggering any obvious alert. The confidentiality impact rated H covers exposure of unpublished drafts and historical revisions that authors may reasonably expect to be private. The availability impact rated L reflects revision record deletion, which removes audit history but does not destroy the live post itself. The vulnerability is not listed in CISA KEV, no EPSS data was provided, and no public exploit code has been identified - these signals suggest exploitation risk is currently theoretical rather than actively observed, though the low complexity and published advisory lower the bar significantly for any attacker with a valid Author credential. The CVSS Scope:Unchanged rating is appropriate - the attacker remains within the CMS application boundary throughout.

An attacker with a low-privileged Author account on a multi-author Vvveb site enumerates integer post_id values by iterating revision list requests against the revisions controller, retrieving draft content from posts they do not own. The attacker then selects a target post, calls the restore operation with a chosen revision_id and the victim's post_id, and silently overwrites the live published post with older or attacker-selected content - with no notification to the post's legitimate owner.