Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post revision operations allow a low-privileged Author to access revisions for posts owned by another Author. The admin/controller/content/revisions.php controller and admin/sql/sqlite/post_content_revision.sql queries trust caller-controlled post_id, language_id, and created_at values without consistently applying the current admin_id to revision lists, reads, restores, and deletes. An attacker can read historic post content, restore a revision over another Author's live post content, or delete revision records, exposing drafts, corrupting published content, and removing audit history. This issue is fixed in version 1.0.8.4.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-08-18 | 2 | Disclosure1General1 |
| 2026-08-27 | 1 | Patch1 |
🚨 HIGH: CVE-2026-49224 (CVSS 8.3) - Vvveb CMS authorization bypass allows low-privileged Authors to access, modify, or delete other Authors' post revisions. Fixed in v1.0.8.4. Patch immediately. #CVE #Vulnerability #PatchNow https://t.co/jfFTQGAvDf
Post summary
The tweet announces CVE-2026-49224, details its authorization bypass flaw and CVSS score, and urges immediate patching to fix the issue.
🚨*CVE* CVE-2026-49224 Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post revision operations allow… https://www.cve.org/CVERecord?id=CVE-2026-49224 ----- Traducción: CVE-2026-49224 Vvv… https://infoflow.cloud`
Post summary
The tweet references CVE-2026-49224 for Vvveb CMS but provides no substantive details on the vulnerability, exploitation, or mitigation.
CVE-2026-49224 Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post revision operations allow… https://www.cve.org/CVERecord?id=CVE-2026-49224
Post summary
The text announces CVE‑2026‑49224 against Vvveb CMS and links to the CVE record, providing a brief technical hint but no PoC, exploit, or patch information.