Live › vulnerability › CVE-2026-121560
LogChimp 0.9.0-alpha.1 before 0.9.3 lets an authenticated post author edit any other post by sending mismatched postId and id parameters. An attacker can overwrite the title, slug, content, boardId and roadmap_id of a victim's post.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 16:21 UTC. All times on this page are UTC.
Teams running a self-hosted LogChimp instance on an affected version where authors can log in and create posts. Instances on 0.9.3 or later are not affected by this issue. Who can skip it: anyone not running LogChimp.
No product ranges from the sources yet.
0.9.0-alpha.1 up to but not including 0.9.3 are affected.0.9.3 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that allows authenticated post authors to modify any other post by supplying mismatched postId and id body parameters. Attackers can set postId to their own post and id to an enumerated victim post UUID to overwrite its title, slug, content, boardId and roadmap_id.
This page as .md · .json · in your agent: get_signal("CVE-2026-121560")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.