CVE-2026-126373

Name of the Vulnerable Software and Affected Versions Vvveb versions 1.0.8.4 through 1.0.8.6

Description An authorization bypass exists in the content/revisions revision action. This issue allows users with low-privileged Author roles to read revisions created by other authors. By providing the post id, language id, and created at timestamp, an attacker can retrieve private unpublished drafts because the revision() function lacks the admin id ownership restriction.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.