# CVE-2026-46408: Vvveb CMS authorization bypass in checkout endpoint

Source: https://junglewise.ai/threats/cve-2026-46408-vvveb-cms-authorization-bypass-in-checkout-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-15. Updated: 2026-05-15  
License: CC BY 4.0 with a link back

CVE-2026-46408 · Severity: high · CVSS 7.6 · Published 2026-05-15

Vvveb CMS, a platform used for building websites and e-commerce stores, contains a security flaw in its checkout process. An attacker logged into the system can access and use another customer's shopping cart by simply changing a numerical ID in the web address. This allows unauthorized users to interfere with the order process, potentially leading to incorrect order fulfillment or the exposure of another customer's intended purchases.

Technologies: [Givanz Vvveb CMS](https://junglewise.ai/threats/technologies/vvveb-cms). Vendors: [Givanz](https://junglewise.ai/threats/vendors/givanz).

## Quick answers

**Is CVE-2026-46408 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46408 being exploited in the wild.

**How severe is CVE-2026-46408?** High severity, with a CVSS score of 7.6, published 15 May 2026.

**Which products and versions are affected?** Givanz Vvveb CMS < 1.0.8.3.

**Is there a fix for CVE-2026-46408?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-46408 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-46408?** Check whether you run Givanz Vvveb CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in Vvveb CMS prior to version 1.0.8.3 due to a lack of ownership verification in the checkout endpoint. The application loads cart data based on a user-supplied 'cart_id' parameter without verifying if the cart belongs to the authenticated session. An attacker with a valid account can provide a predictable cart identifier to load another user's cart into their own checkout flow. This allows the attacker to proceed through the payment and order creation process using the victim's cart contents. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key) and is resolved in version 1.0.8.3.

## Affected products

- givanz Vvveb CMS < 1.0.8.3

## Timeline

- 2026-05-13: advisory: GitHub Security Advisory published by vendor
- 2026-05-15: disclosed: CVE published to NVD

## References

- [https://github.com/givanz/Vvveb/security/advisories/GHSA-rmh2-wv73-xpqh](https://github.com/givanz/Vvveb/security/advisories/GHSA-rmh2-wv73-xpqh)

## Related threats

- [Givanz Vvveb CMS SQL injection in order history page](https://junglewise.ai/threats/cve-2026-45800-givanz-vvveb-cms-sql-injection-in-order-history-page)
- [Vvveb CMS reflected XSS in product return form](https://junglewise.ai/threats/cve-2026-45622-vvveb-cms-reflected-xss-in-product-return-form)
- [Vvveb CMS negative quantity input validation in cart-add endpoint](https://junglewise.ai/threats/cve-2026-44826-vvveb-cms-negative-quantity-input-validation-in-cart-add-endpoint)
- [Givanz Vvveb CMS Stored XSS in comment author field](https://junglewise.ai/threats/cve-2026-44366-givanz-vvveb-cms-stored-xss-in-comment-author-field)
- [Givanz Vvveb CMS reflected XSS in visual editor preview renderer](https://junglewise.ai/threats/cve-2026-41929-givanz-vvveb-cms-reflected-xss-in-visual-editor-preview-renderer)