Vvveb, a CMS used for web sites, blogs, and e‑commerce, contains an authorization flaw in product review handling. In backend operations the database queries accept a vendor‑controlled product_review_id but do not verify that the product’s admin_id matches the vendor’s admin_id. A vendor can therefore read pending review content, ratings, author data, and moderation status for another vendor’s product. The attacker can also change the review status, edit the review text, or delete the review, thereby compromising the integrity and confidentiality of product reviews.

All installations of the Vvveb content management system built by givanz using versions older than 1.0.8.4 are affected. The flaw exists in the product_review table handling in the SQL scripts shipped with the CMS. Any vendor account that has access to the backend review interface on the affected CMS can exploit the vulnerability.

With a CVSS score of 7.6 the flaw is considered high severity. No EPSS data is currently available; the vulnerability is not yet listed in the CISA KEV catalog. Based on the description, the attack vector is inferred to be remote, as the exploitation only requires a vendor‑level login to the CMS backend. Once authenticated, the attacker can supply arbitrary product_review_id values to manipulate reviews across vendors. The lack of authentication checks makes the exploitation straightforward for anyone with vendor access.