Quick answers
- Is CVE-2026-46408 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-46408 being exploited in the wild.
- How severe is CVE-2026-46408?
- High severity, with a CVSS score of 7.6, published 15 May 2026.
- Which products and versions are affected?
- Givanz Vvveb CMS < 1.0.8.3.
- Is there a fix for CVE-2026-46408?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-46408 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-46408?
- Check whether you run Givanz Vvveb CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in Vvveb CMS prior to version 1.0.8.3 due to a lack of ownership verification in the checkout endpoint. The application loads cart data based on a user-supplied 'cart_id' parameter without verifying if the cart belongs to the authenticated session. An attacker with a valid account can provide a predictable cart identifier to load another user's cart into their own checkout flow. This allows the attacker to proceed through the payment and order creation process using the victim's cart contents. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key) and is resolved in version 1.0.8.3.
Affected products
- givanz Vvveb CMS < 1.0.8.3
Timeline
- 2026-05-13: advisory: GitHub Security Advisory published by vendor
- 2026-05-15: disclosed: CVE published to NVD