{"id":"CVE-2026-121560","kind":"vulnerability","aliases":["CVE-2026-121560"],"related":[],"title":"LogChimp: authors can overwrite other users' posts via mismatched IDs","description":"LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that allows authenticated post authors to modify any other post by supplying mismatched postId and id body parameters. Attackers can set postId to their own post and id to an enumerated victim post UUID to overwrite its title, slug, content, boardId and roadmap_id.","summary":"LogChimp 0.9.0-alpha.1 before 0.9.3 lets an authenticated post author edit any other post by sending mismatched postId and id parameters. An attacker can overwrite the title, slug, content, boardId and roadmap_id of a victim's post.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["logchimp","package","self-hosted"],"not_affected_if":["version-0.9.3-or-later"],"how_to_check":"- Check the LogChimp version in use; versions `0.9.0-alpha.1` up to but not including `0.9.3` are affected.","fix":"- Upgrade LogChimp to `0.9.3` or later.","status":"open","published_at":"2026-11-03T16:17:28+00:00","first_seen_at":"2026-11-03T16:21:44+00:00","triaged_at":"2026-11-03T16:23:55+00:00","updated_at":"2026-11-03T16:23:55+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T16:23:55Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade LogChimp to `0.9.3` or later.","reach":"internet","title":"LogChimp: authors can overwrite other users' posts via mismatched IDs","impact":"medium","summary":"LogChimp 0.9.0-alpha.1 before 0.9.3 lets an authenticated post author edit any other post by sending mismatched postId and id parameters. An attacker can overwrite the title, slug, content, boardId and roadmap_id of a victim's post.","audience":"businesses","category":"package","nicknames":[],"who_cares":["logchimp","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"attacker overwrites other authors' post content and fields","analyst_note":"","how_to_check":"- Check the LogChimp version in use; versions `0.9.0-alpha.1` up to but not including `0.9.3` are affected.\n- unknown","plain_action":"","needs_analyst":false,"not_affected_if":["version-0.9.3-or-later"],"who_is_affected":"Teams running a self-hosted LogChimp instance on an affected version where authors can log in and create posts. Instances on `0.9.3` or later are not affected by this issue. Who can skip it: anyone not running LogChimp.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000661,"input_tokens":4207,"output_tokens":480,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121560':13A,16A '-2026':12A,15A '0.9.0':23B,61C '0.9.3':26B,64C 'allow':71C 'alpha.1':24B,62C 'attack':44B,88C 'authent':29B,72C 'author':2A,31B,67C,74C 'boardid':51B,110C 'bodi':86C 'bypass':68C 'contain':65C 'content':50B,109C 'cve':11A,14A 'edit':32B 'enumer':100C 'host':21B 'id':10A,41B,54B,85C,97C,113C 'let':27B 'logchimp':1A,17B,22B,60C 'mismatch':9A,38B,82C 'modifi':76C 'overwrit':4A,46B,105C 'packag':18B 'paramet':42B,87C 'post':7A,30B,35B,59B,73C,79C,95C,102C 'postid':39B,83C,91C 'roadmap':53B,112C 'self':20B 'self-host':19B 'send':37B 'set':90C 'slug':49B,108C 'suppli':81C 'titl':48B,107C 'user':6A 'uuid':103C 'via':8A 'victim':57B,101C 'vulner':69C","nicknames":[],"mitigations":[],"who_affected":"Teams running a self-hosted LogChimp instance on an affected version where authors can log in and create posts. Instances on `0.9.3` or later are not affected by this issue. Who can skip it: anyone not running LogChimp.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","logchimp","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-03T16:17:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121560","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121560","severity":null,"published_at":"2026-11-03T16:17:28+00:00","modified_at":"2026-11-03T16:17:28+00:00","first_seen_at":"2026-11-03T16:21:44+00:00","fetched_at":"2026-11-03T16:21:44+00:00","note":null}],"documents":[{"id":58856,"url":"https://github.com/logchimp/logchimp/commit/a78b69af342908472ad400285187e43729295a7c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58857,"url":"https://github.com/logchimp/logchimp/releases/tag/v0.9.3","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":58858,"url":"https://www.vulncheck.com/advisories/logchimp-before-0.9.3-authorization-bypass-via-patch-api-v1-posts","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}