The Vvveb checkout endpoint accepted a cart_id supplied by an attacker without verifying that the cart belonged to the authenticated user. This direct‑access, or IDOR (CWE‑639), allowed a logged‑in attacker to reuse another user’s cart data, potentially completing purchases on behalf of the victim and causing financial loss or fraudulent transactions.

The vulnerability affects the Vvveb content management system developed by givanz and applies to versions prior to 1.0.8.3, meaning any installation running a version earlier than that release is susceptible.

With a CVSS score of 7.6 the issue is classified as high severity. Although no EPSS score is available and it is not listed in the CISA KEV catalog, the need for only a logged‑in attacker lowers the barrier of exploitation. An attacker can gain unauthorized control over cart contents, resulting in potential fraud or unauthorized chargebacks.