CVE-2026-46408 Details

A vulnerability exists in Vvveb CMS versions prior to 1.0.8.3, allowing logged-in attackers to exploit the checkout endpoint. The issue arises because the endpoint accepts a user-controlled cart_id and enters the payment flow without verifying cart ownership. This flaw enables attackers to reuse another user's cart data during their own checkout session, potentially disrupting order creation and related business processes.

Users are advised to update to Vvveb version 1.0.8.3 or later. To address this vulnerability, implement a verification process for cart ownership before loading checkout data. Ensure that only carts belonging to the current user or session are accepted, and return a 403 or 404 status for unauthorized carts.