CVE-2026-46408

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46408", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-13T21:04:10.932Z", "datePublished": "2026-05-15T18:46:31.693Z", "dateUpdated": "2026-05-15T19:53:13.706Z"}, "containers": {"cna": {"title": "Vvveb: checkout IDOR allows unauthorized reuse of another user's cart", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/givanz/Vvveb/security/advisories/GHSA-rmh2-wv73-xpqh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-rmh2-wv73-xpqh"}], "affected": [{"vendor": "givanz", "product": "Vvveb", "versions": [{"version": "< 1.0.8.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-15T18:46:31.693Z"}, "descriptions": [{"lang": "en", "value": "Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, the checkout endpoint accepts a user-controlled cart_id and uses it to enter the payment flow without verifying cart ownership. A logged-in attacker can therefore reuse another user's cart data in their own checkout session. This vulnerability is fixed in 1.0.8.3."}], "source": {"advisory": "GHSA-rmh2-wv73-xpqh", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-rmh2-wv73-xpqh", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-15T19:52:41.934191Z", "id": "CVE-2026-46408", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-15T19:53:13.706Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-46408", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-15T19:52:41.934191Z"}}}], "references": [{"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-rmh2-wv73-xpqh", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-15T19:52:54.841Z"}}], "cna": {"title": "Vvveb: checkout IDOR allows unauthorized reuse of another user's cart", "source": {"advisory": "GHSA-rmh2-wv73-xpqh", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "givanz", "product": "Vvveb", "versions": [{"status": "affected", "version": "< 1.0.8.3"}]}], "references": [{"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-rmh2-wv73-xpqh", "name": "https://github.com/givanz/Vvveb/security/advisories/GHSA-rmh2-wv73-xpqh", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, the checkout endpoint accepts a user-controlled cart_id and uses it to enter the payment flow without verifying cart ownership. A logged-in attacker can therefore reuse another user's cart data in their own checkout session. This vulnerability is fixed in 1.0.8.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-15T18:46:31.693Z"}}}, "cveMetadata": {"cveId": "CVE-2026-46408", "state": "PUBLISHED", "dateUpdated": "2026-05-15T19:53:13.706Z", "dateReserved": "2026-05-13T21:04:10.932Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-15T18:46:31.693Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Vvveb", "vendor": "givanz", "versions": [{"status": "affected", "version": "< 1.0.8.3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, the checkout endpoint accepts a user-controlled cart_id and uses it to enter the payment flow without verifying cart ownership. A logged-in attacker can therefore reuse another user's cart data in their own checkout session. This vulnerability is fixed in 1.0.8.3."}, {"lang": "es", "value": "Vvveb es un CMS potente y f\u00e1cil de usar con un constructor de p\u00e1ginas para crear sitios web, blogs o tiendas de comercio electr\u00f3nico. Antes de la versi\u00f3n 1.0.8.3, el endpoint de pago acepta un cart_id controlado por el usuario y lo utiliza para entrar en el flujo de pago sin verificar la propiedad del carrito. Un atacante autenticado puede, por lo tanto, reutilizar los datos del carrito de otro usuario en su propia sesi\u00f3n de pago. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 1.0.8.3."}], "id": "CVE-2026-46408", "lastModified": "2026-10-26T00:10:00.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46408", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-15T19:52:41.934191Z", "version": "2.0.3"}}]}, "published": "2026-05-15T19:17:04.460", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-rmh2-wv73-xpqh"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-rmh2-wv73-xpqh"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.0.8.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Vvveb", "source": "cna", "vendor": "givanz"}, "product": "vvveb", "vendor": "givanz"}], "created": "2026-05-15T20:45:07.967707+00:00", "updated": "2026-05-15T20:45:08.256232+00:00", "vendors": ["givanz", "givanz$PRODUCT$vvveb"]}