CVE-2026-49226 is an authorization bypass vulnerability in Vvveb CMS before version 1.0.8.4. The backend controller (admin/controller/content/posts.php) improperly allows a low-privileged Author to manipulate the filter[admin_id] parameter, overriding server-enforced ownership restrictions. Additionally, the post_id parameter for duplicate and delete actions is caller-controlled, and the SQLite database script (admin/sql/sqlite/post.sql) does not consistently enforce post ownership by admin_id. This flaw enables an attacker to view metadata of posts owned by others, discover post identifiers, duplicate posts, or delete posts and related content, leading to exposure of private drafts, content pollution, data loss, and potential business disruption. The vulnerability has a CVSS 3.1 score of 8.3 (high severity) and is fixed in version 1.0.8.4.

An attacker with low-privileged Author access can bypass authorization controls to access, duplicate, or delete posts owned by other Authors. This can expose private draft content, cause unauthorized content duplication or deletion, resulting in data loss and disruption of business operations.

Upgrade Vvveb to version 1.0.8.4 or later, where this authorization bypass vulnerability is fixed. No additional mitigation is required if the system is updated.