Vvveb allows a low‑privileged Author to view, restore, or delete the post revisions of other Authors. The backend uses caller‑controlled post identifiers, language identifiers, and timestamps without checking the current admin identifier. An attacker who is authenticated as an Author can therefore read historical content, overwrite another Author’s live post with an older revision, or erase revision history. This leads to exposure of draft material, corruption of published content, and loss of audit trails.

The vulnerability exists in the Vvveb CMS (vendor givanz). All releases prior to 1.0.8.4 are affected. Affected code resides in admin/controller/content/revisions.php and admin/sql/sqlite/post_content_revision.sql.

The CVSS score of 8.3 signifies high severity. Although the EPSS score is not available and the flaw is not listed in the CISA KEV catalog, the exploitability is limited to users who already have an authenticated Author role. The attacker must supply valid post_id, language_id, and created_at values and can then bypass authorization checks to perform revision operations. The impact spans confidentiality (unauthorized reading) and integrity (restoring or deleting content).