CVE-2026-49222

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.4

Description Backend product question operations allow a low-privileged Vendor to manage questions associated with products belonging to other Vendors. The endpoint 'admin/sql/sqlite/product question.sql' accepts a caller-controlled product question id and fails to verify the product question.product id against the product.admin id for the current admin id. This allows an attacker to read pending question content and moderation data, modify question status, edit content, or delete questions, thereby compromising the integrity and visibility of product Q&A.

Recommendations Update to version 1.0.8.4.