CVE-2026-49228

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.4

Description Backend product operations allow a low-privileged Vendor to access products owned by another Vendor. The 'admin/controller/product/products.php' endpoint accepts a caller-controlled product id for duplicate and delete actions. Additionally, 'admin/sql/sqlite/product.sql' loads and mutates products without consistently applying the current admin id when view other products or edit other products is absent. This allows an attacker to read product details, duplicate products, or delete products and related catalog data, which can lead to the exposure of commercial information, unauthorized copies, catalog pollution, data loss, or business disruption.

Recommendations Update to version 1.0.8.4.