{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35173", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-01T17:26:21.133Z", "datePublished": "2026-04-06T17:48:52.681Z", "dateUpdated": "2026-04-06T18:47:56.696Z"}, "containers": {"cna": {"title": "Chyrp Lite has an IDOR via Mass Assignment in Post Model", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-914", "lang": "en", "description": "CWE-914: Improper Control of Dynamically-Identified Variables", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/xenocrat/chyrp-lite/security/advisories/GHSA-8c3h-rh2j-fxr9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/xenocrat/chyrp-lite/security/advisories/GHSA-8c3h-rh2j-fxr9"}], "affected": [{"vendor": "xenocrat", "product": "chyrp-lite", "versions": [{"version": "< 2026.01", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-06T17:48:52.681Z"}, "descriptions": [{"lang": "en", "value": "Chyrp Lite is an ultra-lightweight blogging engine. Prior to 2026.01, an IDOR / Mass Assignment issue exists in the Post model that allows authenticated users with post editing permissions (Edit Post, Edit Draft, Edit Own Post, Edit Own Draft) to modify posts they do not own and do not have permission to edit. By passing internal class properties such as id into the post_attributes payload, an attacker can alter the object being instantiated. As a result, further actions are performed on another user\u2019s post rather than the attacker\u2019s own post, effectively enabling post takeover. This vulnerability is fixed in 2026.01."}], "source": {"advisory": "GHSA-8c3h-rh2j-fxr9", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-06T18:47:45.411194Z", "id": "CVE-2026-35173", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T18:47:56.696Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-35173", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-06T18:47:45.411194Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T18:47:52.905Z"}}], "cna": {"title": "Chyrp Lite has an IDOR via Mass Assignment in Post Model", "source": {"advisory": "GHSA-8c3h-rh2j-fxr9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "xenocrat", "product": "chyrp-lite", "versions": [{"status": "affected", "version": "< 2026.01"}]}], "references": [{"url": "https://github.com/xenocrat/chyrp-lite/security/advisories/GHSA-8c3h-rh2j-fxr9", "name": "https://github.com/xenocrat/chyrp-lite/security/advisories/GHSA-8c3h-rh2j-fxr9", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Chyrp Lite is an ultra-lightweight blogging engine. Prior to 2026.01, an IDOR / Mass Assignment issue exists in the Post model that allows authenticated users with post editing permissions (Edit Post, Edit Draft, Edit Own Post, Edit Own Draft) to modify posts they do not own and do not have permission to edit. By passing internal class properties such as id into the post_attributes payload, an attacker can alter the object being instantiated. As a result, further actions are performed on another user\u2019s post rather than the attacker\u2019s own post, effectively enabling post takeover. This vulnerability is fixed in 2026.01."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-914", "description": "CWE-914: Improper Control of Dynamically-Identified Variables"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-06T17:48:52.681Z"}}}, "cveMetadata": {"cveId": "CVE-2026-35173", "state": "PUBLISHED", "dateUpdated": "2026-04-06T18:47:56.696Z", "dateReserved": "2026-04-01T17:26:21.133Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-06T17:48:52.681Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Chyrp Lite is an ultra-lightweight blogging engine. Prior to 2026.01, an IDOR / Mass Assignment issue exists in the Post model that allows authenticated users with post editing permissions (Edit Post, Edit Draft, Edit Own Post, Edit Own Draft) to modify posts they do not own and do not have permission to edit. By passing internal class properties such as id into the post_attributes payload, an attacker can alter the object being instantiated. As a result, further actions are performed on another user\u2019s post rather than the attacker\u2019s own post, effectively enabling post takeover. This vulnerability is fixed in 2026.01."}], "id": "CVE-2026-35173", "lastModified": "2026-04-06T18:16:43.523", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-04-06T18:16:43.523", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/xenocrat/chyrp-lite/security/advisories/GHSA-8c3h-rh2j-fxr9"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}, {"lang": "en", "value": "CWE-914"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2026.01)"}}], "enrichment": {"confidence": 83.0, "confidence_source": "matching", "scores": [{"score": 83.0, "source": "matching"}]}, "original": {"product": "chyrp-lite", "source": "cna", "vendor": "xenocrat"}, "product": "chyrp-lite", "vendor": "xenocrat_project"}], "analysis": {"en": {"generated_at": "2026-04-07T02:21:34.248460+00:00", "value": {"mitigation_remediation": ["Upgrade Chyrp Lite to version 2026.01 or later."], "summary": {"action": "Patch", "impact": "Unauthorized Post Modification"}, "threat_synthesis": {"affected_systems": "The issue impacts Chyrp Lite from xenocrat. Any installation running a version before 2026.01 is vulnerable, while releases from 2026.01 onward contain the fix.", "description_and_impact": "This vulnerability enables an authenticated user with any post editing permission to modify content that belongs to other users. By including internal class properties such as the post ID in a post_attributes payload, the attacker can instantiate a Post object that references another user's entry, effectively taking over that content through a typical IDOR combined with mass assignment.", "risk_and_exploitability": "The CVSS score of 6.5 indicates moderate severity. Because the flaw requires the attacker to be an authenticated user with post editing rights, the attack scope is limited to users who can edit content. No publicly disclosed exploits exist, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. Exploitation is straightforward for users with the necessary permissions: they can craft a payload that includes the target post ID, override the binding, and repurpose the content. Preventive measures involve upgrading to the patched version or restricting edit privileges for untrusted users."}}}}, "created": "2026-04-07T06:54:51.419045+00:00", "updated": "2026-04-07T09:37:56.361658+00:00", "vendors": ["xenocrat_project", "xenocrat_project$PRODUCT$chyrp-lite"]}