CVE-2026-46408 HIGH

CVE-2026-46408: Vvveb: checkout IDOR allows unauthorized reuse of another user's cart

Vendor Givanz
Product Vvveb
Weakness CWE-639 · IDOR
Published May 15, 2026
Last update May 15, 2026
View on NVD All CVEs

CVSS base score

7.6/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

What the vulnerability does

01Description

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, the checkout endpoint accepts a user-controlled cart_id and uses it to enter the payment flow without verifying cart ownership. A logged-in attacker can therefore reuse another user's cart data in their own checkout session. This vulnerability is fixed in 1.0.8.3.

Key dates

02Disclosure timeline

May 15, 2026 CVE published
May 15, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2022-4799 Authorization Bypass Through User-Controlled Key in usememos/memos CVE-2023-43668 Apache InLong: Jdbc Connection Security Bypass in InLong CVE-2024-10855 Image Optimizer, Resizer and CDN – Sirv <= 7.3.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Option Deletion CVE-2025-66132 WordPress FAPI Member plugin <= 2.2.30 - Insecure Direct Object References (IDOR) vulnerability CVE-2026-32589 Mirror-registry: quay: insecure direct object reference in blobupload