CVE-2026-49224

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.4

Description Backend post revision operations allow a low-privileged Author to access revisions for posts owned by another Author. The 'admin/controller/content/revisions.php' controller and 'admin/sql/sqlite/post content revision.sql' queries trust caller-controlled post id, language id, and created at values without consistently applying the current admin id to revision lists, reads, restores, and deletes. This allows an attacker to read historic post content, restore a revision over another Author's live post content, or delete revision records, which can expose drafts, corrupt published content, and remove audit history.

Recommendations Update to version 1.0.8.4.