---
id: CVE-2026-121560
title: LogChimp before 0.9.3 Authorization Bypass via PATCH /api/v1/posts
summary: >-
  LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass
  vulnerability that allows authenticated post authors to modify any other post
  by supplying mismatched postId and id body parameters. Attackers can set
  postId to their o…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L'
cvssSource: cna
cwe:
  - CWE-639
vendor: logchimp
product: logchimp
affected:
  - logchimp >= 0.9.0-alpha.1 < 0.9.3
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-03T16:42:12.790602Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T16:42:29.845Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121560'
references:
  - url: >-
      https://github.com/logchimp/logchimp/commit/a78b69af342908472ad400285187e43729295a7c
    label: Patch Commit
  - url: 'https://github.com/logchimp/logchimp'
  - url: >-
      https://github.com/logchimp/logchimp/blob/v0.9.2/packages/server/src/controllers/post/updatePost.ts#L67
  - url: >-
      https://github.com/logchimp/logchimp/blob/v0.9.2/packages/server/src/middlewares/postExists.ts#L72-L77
  - url: 'https://github.com/logchimp/logchimp/releases/tag/v0.9.3'
    label: logchimp v0.9.3 Release Notes
  - url: >-
      https://www.vulncheck.com/advisories/logchimp-before-0.9.3-authorization-bypass-via-patch-api-v1-posts
    label: >-
      VulnCheck Advisory: LogChimp before 0.9.3 Authorization Bypass via PATCH
      /api/v1/posts
tags:
  - cve.org
epss: 0.0045
epssPercentile: 0.3934
ingestedAt: '2026-11-05T20:33:06.290Z'
---

## Overview

LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that allows authenticated post authors to modify any other post by supplying mismatched postId and id body parameters. Attackers can set postId to their own post and id to an enumerated victim post UUID to overwrite its title, slug, content, boardId and roadmap_id.

## Affected

- `logchimp >= 0.9.0-alpha.1 < 0.9.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.