Vvveb versions prior to 1.0.8.4 suffer from an authorization bypass that allows any authenticated Author to view, duplicate, or delete posts belonging to other authors. The vulnerability is caused by the backend controller permitting a caller‑controlled filter[admin_id] to override the server‑selected admin_id, coupled with inconsistent enforcement of post.admin_id in the database schema. This flaw enables an attacker to read post metadata, duplicate content, or delete drafts and associated media, leading to information disclosure, data loss, and potential business disruption.

Vvveb, the content management system provided by givanz, is affected. All releases older than version 1.0.8.4 are vulnerable. The fix is applied in 1.0.8.4 and later releases, so any installation running a pre‑1.0.8.4 build must be considered at risk.

The CVSS score of 8.3 indicates a high‑severity flaw. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, meaning no confirmed exploits have been reported to date. However, the vulnerability can be exploited by any user with Author privileges by crafting HTTP requests to the posts controller with a manipulated filter[admin_id] and post_id. The attack vector is inferred to be internal, authenticated, non‑privileged users, so organizations with many author accounts represent a larger attack surface. Given the lack of public exploitation, early patching is strongly recommended.