CVE-2026-126375

Description

Vvveb through 1.0.8.6 contains a missing authorization vulnerability that allows low-privilege vendors to rename, delete, or overwrite other vendors' digital-asset files in the shared storage/digital_assets directory. Attackers can send rename, delete, or upload requests to product/digital-asset with another vendor's filename to break downloads or substitute malicious content.

References

• https://github.com/givanz/Vvveb/security/advisories/GHSA-387r-2vfq-vrmf
• https://www.vulncheck.com/advisories/vvveb-through-1.0.8.6-cross-tenant-digital-asset-tampering-via-media-trait