CVE-2026-49227

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.4

Description Backend comment operations allow a low-privileged Author to manage comments associated with posts created by other authors. The controllers 'admin/controller/content/comment.php' and 'admin/controller/content/comments.php', as well as the 'admin/sql/sqlite/comment.sql' queries, accept a caller-controlled comment id without verifying if the comment.post id matches the post.admin id of the current user. This allows an attacker to read pending comment content and commenter email addresses, modify moderation status, edit comment content, or delete comments, thereby bypassing author and moderation boundaries.

Recommendations Update to version 1.0.8.4.