Quick answers
- Is CVE-2026-44826 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-44826 being exploited in the wild.
- How severe is CVE-2026-44826?
- High severity, with a CVSS score of 7.5, published 15 May 2026.
- Which products and versions are affected?
- Givanz Vvveb CMS < 1.0.8.2.
- Is there a fix for CVE-2026-44826?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-44826 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-44826?
- Check whether you run Givanz Vvveb CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in the cart-add handler of Vvveb CMS due to a lack of input validation on the 'quantity' parameter. An unauthenticated attacker can submit a negative integer via a POST request to the cart-add endpoint. The application processes this value without sanitization, propagating the negative sign through all downstream business logic, including line totals, tax calculations, and the final grand total. This results in the persistence of orders with negative values in the merchant's database. The flaw is exploitable by any guest user without special configuration or CSRF tokens. The issue is resolved in version 1.0.8.2 by enforcing positive integer checks on quantities.
Affected products
- givanz Vvveb CMS < 1.0.8.2
Timeline
- 2026-05-04: advisory: GitHub security advisory published
- 2026-05-15: disclosed: CVE published to NVD