Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-35173— Chyrp Lite has an IDOR via Mass Assignment in Post Model

Quick assessment

Affected
xenocrat chyrp-lite
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

chyrp-lite是Daniel Pimley个人开发者的一个自托管的博客与网站发布平台。 chyrp-lite 2026.01之前版本存在安全漏洞，该漏洞源于Post模型存在不安全的直接对象引用或批量赋值问题，可能导致文章接管。

CVSS 6.5 · Medium EPSS 0.17% · P7
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-35173

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Chyrp Lite has an IDOR via Mass Assignment in Post Model
Source: CVE Program / CVE List V5
Vulnerability Description
Chyrp Lite is an ultra-lightweight blogging engine. Prior to 2026.01, an IDOR / Mass Assignment issue exists in the Post model that allows authenticated users with post editing permissions (Edit Post, Edit Draft, Edit Own Post, Edit Own Draft) to modify posts they do not own and do not have permission to edit. By passing internal class properties such as id into the post_attributes payload, an attacker can alter the object being instantiated. As a result, further actions are performed on another user’s post rather than the attacker’s own post, effectively enabling post takeover. This vulnerability is fixed in 2026.01.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Vulnerability Title
chyrp-lite 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
chyrp-lite是Daniel Pimley个人开发者的一个自托管的博客与网站发布平台。 chyrp-lite 2026.01之前版本存在安全漏洞，该漏洞源于Post模型存在不安全的直接对象引用或批量赋值问题，可能导致文章接管。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
xenocrat chyrp-lite < 2026.01 -

II. Public POCs for CVE-2026-35173

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-35173

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-35173 (1)

IV. Related Vulnerabilities

Same product: chyrp-lite
Same vendor: xenocrat
Same weakness: CWE-639

V. Comments for CVE-2026-35173

No comments yet

Leave a comment