---
id: "CVE-2026-121560"
kind: "vulnerability"
aliases: ["CVE-2026-121560"]
title: "LogChimp: authors can overwrite other users' posts via mismatched IDs"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["logchimp", "package", "self-hosted"]
not_affected_if: ["version-0.9.3-or-later"]
published_at: "2026-11-03T16:17:28+00:00"
first_seen_at: "2026-11-03T16:21:44+00:00"
updated_at: "2026-11-03T16:23:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121560", "first_seen_at": "2026-11-03T16:21:44+00:00"}]
---

# LogChimp: authors can overwrite other users' posts via mismatched IDs

LogChimp 0.9.0-alpha.1 before 0.9.3 lets an authenticated post author edit any other post by sending mismatched postId and id parameters. An attacker can overwrite the title, slug, content, boardId and roadmap_id of a victim's post.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the LogChimp version in use; versions `0.9.0-alpha.1` up to but not including `0.9.3` are affected.

## Fix

- Upgrade LogChimp to `0.9.3` or later.

## Timeline

- 2026-11-03T16:21:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121560

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/logchimp-before-0.9.3-authorization-bypass-via-patch-api-v1-posts
- [fix] Patch: github.com https://github.com/logchimp/logchimp/commit/a78b69af342908472ad400285187e43729295a7c
- [fix] Release notes: github.com https://github.com/logchimp/logchimp/releases/tag/v0.9.3

## From the sources

LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that allows authenticated post authors to modify any other post by supplying mismatched postId and id body parameters. Attackers can set postId to their own post and id to an enumerated victim post UUID to overwrite its title, slug, content, boardId and roadmap_id.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_