CVE-2026-121560 Details
Description
LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that allows authenticated post authors to modify any other post by supplying mismatched postId and id body parameters. Attackers can set postId to their own post and id to an enumerated victim post UUID to overwrite its title, slug, content, boardId and roadmap_id.
A vulnerability allowing authorization bypass has been identified in LogChimp versions 0.9.0-alpha.1 prior to 0.9.3. This vulnerability allows authenticated post authors to modify any post by sending mismatched postId and id body parameters. Exploitation involves setting postId to the author's own post and id to the UUID of a victim's post, thereby overwriting the title, slug, content, boardId, and roadmap_id of the victim's post.
Users are advised to upgrade to LogChimp version 0.9.4, as this version addresses the vulnerability. The Docker image for version 0.9.3 is not available, so version 0.9.4 should be used for deployment.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| LogChimp | >= 0.9.0-alpha.1, < 0.9.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2026 | New CVE Received | [email protected] |