{"id":"CVE-2026-126784","kind":"vulnerability","aliases":["CVE-2026-126784"],"related":[],"title":"Lagarto Chivato: notice submissions have no rate limit or quota","description":"Missing rate limiting, per-account submission quota and geographic validation in the publicar_aviso RPC function in Lagarto Chivato 0.4.1 and earlier on Web allows remote authenticated attackers to flood the moderation queue via unlimited submission of notices with arbitrary coordinates.","summary":"The publicar_aviso RPC function in Lagarto Chivato 0.4.1 and earlier accepts unlimited notice submissions with arbitrary coordinates. A logged-in attacker can flood the moderation queue.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Lagarto Chivato","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["lagarto-chivato","other","web"],"not_affected_if":["not-running-lagarto-chivato"],"how_to_check":"- Check the installed Lagarto Chivato version against `0.4.1`","fix":null,"status":"open","published_at":"2026-11-11T20:17:07+00:00","first_seen_at":"2026-11-11T20:28:52+00:00","triaged_at":"2026-11-11T20:30:17+00:00","updated_at":"2026-11-11T20:30:17+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-11T20:30:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Lagarto Chivato: notice submissions have no rate limit or quota","impact":"low","summary":"The publicar_aviso RPC function in Lagarto Chivato 0.4.1 and earlier accepts unlimited notice submissions with arbitrary coordinates. A logged-in attacker can flood the moderation queue.","audience":"businesses","category":"other","nicknames":[],"who_cares":["lagarto-chivato","web"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"moderation queue flooded with fake notices at arbitrary coordinates","analyst_note":"Confirm the affected product, its fixed version and any vendor advisory at the NVD entry; the sources give no fix or product ranges.","how_to_check":"- Check the installed Lagarto Chivato version against `0.4.1`\n- unknown","plain_action":"","product_name":"Lagarto Chivato","needs_analyst":true,"not_affected_if":["not-running-lagarto-chivato"],"who_is_affected":"Lagarto Chivato 0.4.1 and earlier, on the Web, where the publicar_aviso RPC function is reachable. The sources do not say which deployments expose it beyond authenticated users, or whether a patched version exists. Teams that do not run this application can skip it.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000717,"input_tokens":4553,"output_tokens":523,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126784':13A,16A '-2026':12A,15A '0.4.1':32B,72C 'accept':35B 'account':57C 'allow':77C 'arbitrari':40B,92C 'attack':46B,80C 'authent':79C 'aviso':26B,66C 'chivato':2A,18A,21B,31B,71C 'coordin':41B,93C 'cve':11A,14A 'earlier':34B,74C 'flood':48B,82C 'function':28B,68C 'geograph':61C 'lagarto':1A,17A,20B,30B,70C 'lagarto-chivato':19B 'limit':8A,54C 'log':44B 'logged-in':43B 'miss':52C 'moder':50B,84C 'notic':3A,37B,90C 'per':56C 'per-account':55C 'publicar':25B,65C 'queue':51B,85C 'quota':10A,59C 'rate':7A,53C 'remot':78C 'rpc':27B,67C 'submiss':4A,38B,58C,88C 'unlimit':36B,87C 'valid':62C 'via':86C 'web':23B,76C","nicknames":[],"mitigations":[],"who_affected":"Lagarto Chivato 0.4.1 and earlier, on the Web, where the publicar_aviso RPC function is reachable. The sources do not say which deployments expose it beyond authenticated users, or whether a patched version exists. Teams that do not run this application can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["chivato","lagartochivato"],"ptokens":["chivato","lagarto"],"labels":["lagartochivato","medium","other","vendor","web"],"campaign_type":null,"search_a":"'-126784':13A,16A '-2026':12A,15A 'chivato':2A,18A 'cve':11A,14A 'lagarto':1A,17A 'limit':8A 'notic':3A 'quota':10A 'rate':7A 'submiss':4A","search_b":"'0.4.1':32B 'accept':35B 'arbitrari':40B 'attack':46B 'aviso':26B 'chivato':21B,31B 'coordin':41B 'earlier':34B 'flood':48B 'function':28B 'lagarto':20B,30B 'lagarto-chivato':19B 'log':44B 'logged-in':43B 'moder':50B 'notic':37B 'publicar':25B 'queue':51B 'rpc':27B 'submiss':38B 'unlimit':36B 'web':23B","search_c":"'0.4.1':72C 'account':57C 'allow':77C 'arbitrari':92C 'attack':80C 'authent':79C 'aviso':66C 'chivato':71C 'coordin':93C 'earlier':74C 'flood':82C 'function':68C 'geograph':61C 'lagarto':70C 'limit':54C 'miss':52C 'moder':84C 'notic':90C 'per':56C 'per-account':55C 'publicar':65C 'queue':85C 'quota':59C 'rate':53C 'remot':78C 'rpc':67C 'submiss':58C,88C 'unlimit':87C 'valid':62C 'via':86C 'web':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T20:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","cvss_by":"772f0079-75c2-41ca-913e-d9072716578b","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126784","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126784","severity":null,"published_at":"2026-11-11T20:17:07+00:00","modified_at":"2026-11-11T20:17:07+00:00","first_seen_at":"2026-11-11T20:28:52+00:00","fetched_at":"2026-11-11T20:28:52+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}