CVE-2026-49226

Estado: AplazadaAlta (8.3)—

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post operations allow a low-privileged Author to access posts owned by another Author. The admin/controller/content/posts.php controller permits filter[admin_id] to replace the server-selected admin_id restriction and accepts a caller-controlled post_id for duplicate and delete actions, while admin/sql/sqlite/post.sql does not consistently enforce post.admin_id. An attacker can view post metadata, discover post identifiers, duplicate posts, or delete posts and related content, exposing private drafts and causing content pollution, data loss, or business disruption. This issue is fixed in version 1.0.8.4.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Puntuación base: 8.3

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.48%
Percentil entre todas las CVEs puntuadas: 39
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1210 Exploitation of Remote Serviceslateral movement75 %
Impacto principalT1565.002 Transmitted Data Manipulationimpact80 %
Impacto secundarioT1491.002 External Defacementimpact75 %
Impacto secundarioT1552.007 Container APIcredential access70 %

Acceso remoto autenticado (PR:L) a funciones backend de posts permitiendo manipulación (duplicar, eliminar) y lectura de datos de otros autores. Requiere privilegios mínimos de autor para acceder a recursos de otros usuarios, clasificado T1210. Los impactos incluyen manipulación de datos (eliminar/d

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account Management Network Segmentation Vulnerability Scanning User Account Management Threat Intelligence Program Limit Access to Resource Over Network

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Vvveb — Vvveb^AI

CWE

CWE-639

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-49226",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-49226",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-08-19T14:46:23.198340Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.3,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 5.5,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "givanz",
          "product": "Vvveb",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.0.8.4"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-08-18T16:17:13.510",
  "references": [
    {
      "url": "https://github.com/givanz/Vvveb/commit/0ce6ba6baf5901aaffa993857ee71c43481a5353",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.4",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-xxx7-8f3v-g9p6",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-xxx7-8f3v-g9p6",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post operations allow a low-privileged Author to access posts owned by another Author. The admin/controller/content/posts.php controller permits filter[admin_id] to replace the server-selected admin_id restriction and accepts a caller-controlled post_id for duplicate and delete actions, while admin/sql/sqlite/post.sql does not consistently enforce post.admin_id. An attacker can view post metadata, discover post identifiers, duplicate posts, or delete posts and related content, exposing private drafts and causing content pollution, data loss, or business disruption. This issue is fixed in version 1.0.8.4."
    }
  ],
  "lastModified": "2026-09-08T21:02:26.047",
  "sourceIdentifier": "security-advisories@github.com"
}