CVE-2026-44826 Details

A vulnerability in Vvveb CMS versions prior to 1.0.8.2 allows for negative quantities to be added to the cart, which are then processed as normal line items but with negative values. This issue arises because the cart-add endpoint does not validate the sign of the quantity parameter. As a result, all downstream calculations, including line totals, subtotals, taxes, and grand totals, become negative. The negative grand total is displayed to the user, accepted during checkout, and recorded in the merchant's database as a legitimate order with a negative total. This creates an inaccurate financial record, suggesting the merchant owes the customer money, a scenario that typically does not occur.

The vulnerability can be fixed by implementing a validation check in the cart-add handler to reject any quantity that is not a positive integer. This check should also be applied in the checkout finalization process to prevent negative-quantity orders from being processed. Additionally, asserting that the order total is greater than or equal to zero during the order creation step can catch any future regressions.