CVE-2026-49222 is an authorization bypass vulnerability in the Vvveb CMS product question management backend. The vulnerability occurs because the SQL queries in admin/sql/sqlite/product_question.sql accept a caller-controlled product_question_id parameter but do not verify that the product_question.product_id belongs to the current admin_id. As a result, a low-privileged vendor can access and manipulate questions under other vendors' products, including reading pending questions and moderation data, changing question status, editing content, or deleting questions. This compromises the integrity and visibility of product Q&A content. The vulnerability affects versions prior to 1.0.8.4 and is resolved in 1.0.8.4.

An attacker with low privileges as a vendor can bypass authorization controls to access and modify product questions of other vendors. This can lead to unauthorized disclosure of pending question content and moderation data, unauthorized modification or deletion of questions, and manipulation of product Q&A visibility and integrity. The impact includes loss of data integrity, confidentiality of pending moderation content, and potential disruption of product-related communications.

This vulnerability is fixed in Vvveb version 1.0.8.4. Users should upgrade to version 1.0.8.4 or later to remediate the issue. No vendor advisory or official patch link was provided, but the fix version is explicitly stated. Until upgrading, restrict vendor privileges or monitor product question management closely to mitigate risk.