Vulnerability · Published Nov 3, 2026 · Assigned by VulnCheck

CVE-2026-121560LogChimp before 0.9.3 Authorization Bypass via PATCH /api/v1/posts

High 7.1

In plain English

A high-severity authorization bypass via user-controlled key in logchimp from logchimp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.4%top 60.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that allows authenticated post authors to modify any other post by supplying mismatched postId and id body parameters. Attackers can set postId to their own post and id to an enumerated victim post UUID to overwrite its title, slug, content, boardId and roadmap_id.

Affected products (as reported)

Vendor	Product	Versions
logchimp	logchimp	0.9.0-alpha.1 – before 0.9.3

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

References

Patch Commit patch
https://github.com/logchimp/logchimp product
https://github.com/logchimp/logchimp/blob/v0.9.2/packages/server/src/controllers/post/updatePost.ts#L67 technical-description
https://github.com/logchimp/logchimp/blob/v0.9.2/packages/server/src/middlewares/postExists.ts#L72-L77 technical-description
logchimp v0.9.3 Release Notes technical-description, release-notes
VulnCheck Advisory: LogChimp before 0.9.3 Authorization Bypass via PATCH /api/v1/posts third-party-advisory