Authorization bypass in LogChimp lets authors overwrite other posts
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
LogChimp versions from 0.9.0-alpha.1 before 0.9.3 contain an authorization bypass in the post update endpoint. An authenticated post author can supply mismatched postId and id body parameters to modify any other post by specifying the victim post's UUID, overwriting its title, slug, content, boardId and roadmap_id. This is classified as CWE-639, Authorization Bypass Through User-Controlled Key.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
Description from the CNA
LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that allows authenticated post authors to modify any other post by supplying mismatched postId and id body parameters. Attackers can set postId to their own post and id to an enumerated victim post UUID to overwrite its title, slug, content, boardId and roadmap_id.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Upgrade LogChimp to version 0.9.3, which fixes the issue. The sources do not list a vendor advisory identifier for this fix.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
- Fix · CNA logchimp (logchimp) Fixed in 0.9.3
Timeline
- 2026-11-03 Threatist record created from CVE-2026-121560
- 2026-11-03 CISA SSVC decision points changed
- 2026-11-03 Priority changed: MEDIUM → LOW
- 2026-11-03 Alias added: GHSA-xjc5-mcwx-53m7
References
Sources
- CVE-2026-121560 · CVE Program
- CVE-2026-121560 · NVD
- FIRST EPSS
- GHSA-xjc5-mcwx-53m7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences