The vulnerability originates from missing validation in product question queries—back‑end SQL requests use a caller‑controlled product_question_id without checking that the referenced product belongs to the calling vendor. An attacker who has any vendor account, even at low privilege, can read, approve, edit, or delete other vendors’ questions. This can expose pending question content, alter moderation data, and change question status, thereby compromising confidentiality and integrity of product Q&A data.

VvvEb, a CMS product by givanz, under versions prior to 1.0.8.4. All affected releases rely on the product_question API that lacks proper authorization checks. The issue was addressed in release 1.0.8.4 and later.

The CVSS score of 7.6 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. The attack vector is inferred to be local—an attacker must first obtain a vendor account, but once authenticated, no further escalation is required. Exploitation requires only access to the vendor login portal and the ability to submit product_question_id values to the backend.