A low‑privileged vendor can read, restore, or delete product revisions that belong to other vendors. This enables disclosure of historic content, overwriting live product pages, and removal of audit records, compromising confidentiality, integrity, and availability. The flaw arises because the platform trusts caller‑controlled product identifiers and timestamps in product revision operations without ensuring they belong to the authenticated vendor.

The vulnerability affects the Vvveb CMS developed by givanz. Any instance running a version earlier than 1.0.8.4 is susceptible, regardless of hosting environment. The backend product revision endpoint at admin/controller/product/revisions.php is the attack surface.

With a CVSS score of 8.3 the issue is classified as high severity. The EPSS score is not available, so exploit probability is unknown, and the flaw is not listed in the CISA KEV catalog. An attacker can exploit the flaw through the web interface by authenticating as any vendor with minimal privileges and invoking the product revisions route—authorization checks are bypassed, allowing non‑owner access to another vendor’s content.