CVE-2026-49228 is an authorization bypass vulnerability in the Vvveb CMS backend prior to version 1.0.8.4. The vulnerability arises from the admin/controller/product/products.php controller accepting a user-controlled product_id parameter for duplicate and delete actions without consistently verifying the current admin_id or vendor ownership. Additionally, the SQL logic in admin/sql/sqlite/product.sql fails to enforce ownership constraints when the permissions view_other_products or edit_other_products are absent. This allows a low-privileged vendor to read, duplicate, or delete products belonging to other vendors, exposing sensitive commercial information and enabling unauthorized modifications to the product catalog. The vulnerability is addressed in version 1.0.8.4.

An attacker with low-privileged vendor access can bypass authorization controls to view, duplicate, or delete products owned by other vendors. This leads to exposure of confidential commercial data, unauthorized product copies, catalog pollution, data loss, and potential disruption to business operations.

Upgrade Vvveb to version 1.0.8.4 or later, where this authorization bypass vulnerability is fixed. No other mitigation is documented. Patch status is confirmed by the vendor stating the issue is fixed in 1.0.8.4.