Vvveb CMS CVE-2026-49226

Exploitation requires a valid, authenticated Author-role account on the target Vvveb CMS installation. The vulnerable code path is admin/controller/content/posts.php, specifically the handling of the filter[admin_id] HTTP parameter in post listing, and the post_id parameter in delete and duplicate backend actions. The installation must have multiple Author accounts for cross-author access to be meaningful - single-author deployments are not practically exploitable for data theft from other users, though self-deletion via crafted requests remains possible. No special server configuration or non-default feature flag is required; the flaw exists in default Vvveb installations across all supported database backends (MySQL, PostgreSQL, SQLite). Exploitation is limited by: (1) the requirement for a valid Author-level credential, and (2) knowledge of victim post IDs, which are discoverable through the same parameter-manipulation technique. Network access to the Vvveb admin backend is required - installations that restrict admin panel access to internal networks or VPN significantly reduce exposure.

The CVSS 8.3 High score is driven by AV:N/AC:L/PR:L/UI:N with high integrity and availability impact, reflecting how straightforward exploitation is once an attacker holds any Author account. The I:H and A:H ratings are well-justified given that an attacker can permanently delete posts and all related content (taxonomies, site mappings, post content) across the full database backend. The C:L rating is accurate - exposure is limited to post metadata and private draft identifiers rather than credentials or session data. No EPSS score was provided in the source data, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is absent from CISA KEV and no public POC was identified at analysis time, which materially reduces the immediate incident-response urgency for most deployments. That said, the IDOR pattern here - substituting a user-controlled integer parameter - is among the simplest attack classes to discover and exploit, requiring no special tooling; even a mid-sized municipal IT team in swidnica running a shared Vvveb editorial installation should treat this as a prompt patching priority rather than a deferred item, because any disgruntled or compromised Author account becomes a content-destruction vector. Single-author deployments face negligible practical risk from the cross-author angle, but should still upgrade to close the attack surface.

An attacker registers or compromises an Author account on a multi-author Vvveb site, then issues crafted HTTP requests to the backend posts list endpoint with filter[admin_id] set to a victim author's ID, revealing that author's private draft post IDs. The attacker then submits delete or duplicate actions referencing those post IDs, permanently removing the victim's content or creating unauthorized copies - no additional privileges or user interaction are required beyond the initial Author login.