CVE-2026-49223

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.4

Description Backend product review operations allow a low-privileged Vendor to manage reviews associated with products belonging to other Vendors. The endpoint 'admin/sql/sqlite/product review.sql' accepts a caller-controlled product review id and fails to verify the product review.product id against the product.admin id for the current admin id. This allows an attacker to read pending review content, ratings, author information, and moderation state, as well as change review status, edit content, or delete reviews, compromising the visibility and integrity of product reviews.

Recommendations Update to version 1.0.8.4.