Vvveb allows a low‑privileged Author to manipulate comments belonging to other Authors because the comment controllers accept a caller‑controlled comment_id without verifying that its post_id matches the author’s own posts. This enables the attacker to read pending comment content and commenter email addresses, change moderation status, edit or delete any other author’s comments, thereby breaching author and moderation boundaries. The weakness aligns with CWE‑639, an authorization bypass through user‑controlled key.

All Vvveb installations running a version earlier than 1.0.8.4 are affected. The CMS version 1.0.8.4 and later contain a fix that checks comment.post_id against the current admin_id before performing any comment operation.

The CVSS score is 7.6, indicating a high severity vulnerability. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog. The attack requires an authenticated connection to the Vvveb backend as an Author; once authenticated, the attacker can exploit the flaw remotely over the network. Given the lack of exploitable public proof yet and the high CVSS score, the overall risk remains high for sites that expose author accounts without additional safeguards.