Vvveb CMS CVE-2026-49227

Exploitation requires a valid low-privileged Author account in the Vvveb admin backend - the CVSS PR:L vector confirms authenticated access is mandatory. The vulnerable endpoints are admin/controller/content/comment.php (single comment view/edit) and admin/controller/content/comments.php (listing, status change, bulk delete). No special CMS configuration or plugin is required; the flaw exists in default installations of any Vvveb instance with multiple Author-level users. Exploitation is limited by the requirement for at least one valid Author credential, meaning open-registration deployments or sites with shared accounts face higher practical risk than tightly controlled installations. Unauthenticated users have no access to these admin controllers.

The CVSS 3.1 score of 7.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L) accurately reflects the risk profile: network-accessible, low complexity, requiring only a low-privilege Author account. The C:L rating is appropriate because the attacker can read pending comment content and commenter email addresses - not arbitrary system data. The I:H rating reflects that the attacker can fully manipulate comments (edit content, change moderation status, delete) with no scope limitation once access is obtained. EPSS data was not provided in the source intelligence, so probabilistic exploitation likelihood cannot be quantified. No CISA KEV listing is present, and no public POC has been identified, suggesting exploitation has not been widely observed in the wild. Real-world risk is moderate: exploitation requires a valid low-privilege account, limiting the attacker pool to insiders, compromised credentials, or self-registered authors on open-registration sites. The highest-impact scenario is on multi-author publishing platforms where content moderation integrity is critical.

An authenticated Author logs into the Vvveb admin panel of a multi-author site and intercepts a legitimate HTTP request to the comment management endpoint. The attacker substitutes their own comment_id with incrementally different integer values, iterating through comments on posts owned by other authors. Without the admin_id ownership check, the server returns comment content and commenter email addresses, and the attacker can then submit requests to delete or alter moderation status on comments they do not own, disrupting editorial workflows. No public POC has been identified, but the attack requires only basic HTTP manipulation skills.