CVE-2026-121560— LogChimp before 0.9.3 Authorization Bypass via PATCH /api/v1/posts

Quick assessment

Affected

logchimp logchimp

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

LogChimp 0.9.0-alpha.1 至 0.9.3 之前的版本中存在一个授权绕过漏洞。该漏洞允许已认证的文章作者通过提供不匹配的和请求体参数，修改任意其他文章。攻击者可将设置为自己文章 ID，同时将设置为枚举获取的受害者文章 UUID，从而覆盖该文章的标题（title）、别名（slug）、内容（content）、板块 ID（boardId）以及路线图 ID（roadmap_id）。

CVSS 7.1 · High Updated Nov 04, 2026

Possible ATT&CK Techniques 2 AI

T1068 · Exploitation for Privilege Escalation T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

LogChimp before 0.9.3 Authorization Bypass via PATCH /api/v1/posts

Source: CVE Program / CVE List V5

Vulnerability Description

LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that allows authenticated post authors to modify any other post by supplying mismatched postId and id body parameters. Attackers can set postId to their own post and id to an enumerated victim post UUID to overwrite its title, slug, content, boardId and roadmap_id.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

通过用户控制密钥绕过授权机制

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
logchimp	logchimp	0.9.0-alpha.1 ~ 0.9.3	-

II. Public POCs for CVE-2026-121560

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-121560

请登录查看更多情报信息。

Other References for CVE-2026-121560 (6)

https://github.com/logchimp/logchimp/blob/v0.9.2/packages/server/src/controllers/post/updatePost.ts#L67 technical-description
https://github.com/logchimp/logchimp/blob/v0.9.2/packages/server/src/middlewares/postExists.ts#L72-L77 technical-description
https://github.com/logchimp/logchimp product
https://github.com/logchimp/logchimp/commit/a78b69af342908472ad400285187e43729295a7c patch
https://github.com/logchimp/logchimp/releases/tag/v0.9.3 technical-description release-notes
https://www.vulncheck.com/advisories/logchimp-before-0.9.3-authorization-bypass-via-patch-api-v1-posts third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-121560

IV. Related Vulnerabilities

Same weakness: CWE-639