CVE-2026-35173

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35173", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-01T17:26:21.133Z", "datePublished": "2026-04-06T17:48:52.681Z", "dateUpdated": "2026-04-06T18:47:56.696Z"}, "containers": {"cna": {"title": "Chyrp Lite has an IDOR via Mass Assignment in Post Model", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-914", "lang": "en", "description": "CWE-914: Improper Control of Dynamically-Identified Variables", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/xenocrat/chyrp-lite/security/advisories/GHSA-8c3h-rh2j-fxr9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/xenocrat/chyrp-lite/security/advisories/GHSA-8c3h-rh2j-fxr9"}], "affected": [{"vendor": "xenocrat", "product": "chyrp-lite", "versions": [{"version": "< 2026.01", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-06T17:48:52.681Z"}, "descriptions": [{"lang": "en", "value": "Chyrp Lite is an ultra-lightweight blogging engine. Prior to 2026.01, an IDOR / Mass Assignment issue exists in the Post model that allows authenticated users with post editing permissions (Edit Post, Edit Draft, Edit Own Post, Edit Own Draft) to modify posts they do not own and do not have permission to edit. By passing internal class properties such as id into the post_attributes payload, an attacker can alter the object being instantiated. As a result, further actions are performed on another user\u2019s post rather than the attacker\u2019s own post, effectively enabling post takeover. This vulnerability is fixed in 2026.01."}], "source": {"advisory": "GHSA-8c3h-rh2j-fxr9", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-06T18:47:45.411194Z", "id": "CVE-2026-35173", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T18:47:56.696Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-35173", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-06T18:47:45.411194Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T18:47:52.905Z"}}], "cna": {"title": "Chyrp Lite has an IDOR via Mass Assignment in Post Model", "source": {"advisory": "GHSA-8c3h-rh2j-fxr9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "xenocrat", "product": "chyrp-lite", "versions": [{"status": "affected", "version": "< 2026.01"}]}], "references": [{"url": "https://github.com/xenocrat/chyrp-lite/security/advisories/GHSA-8c3h-rh2j-fxr9", "name": "https://github.com/xenocrat/chyrp-lite/security/advisories/GHSA-8c3h-rh2j-fxr9", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Chyrp Lite is an ultra-lightweight blogging engine. Prior to 2026.01, an IDOR / Mass Assignment issue exists in the Post model that allows authenticated users with post editing permissions (Edit Post, Edit Draft, Edit Own Post, Edit Own Draft) to modify posts they do not own and do not have permission to edit. By passing internal class properties such as id into the post_attributes payload, an attacker can alter the object being instantiated. As a result, further actions are performed on another user\u2019s post rather than the attacker\u2019s own post, effectively enabling post takeover. This vulnerability is fixed in 2026.01."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-914", "description": "CWE-914: Improper Control of Dynamically-Identified Variables"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-06T17:48:52.681Z"}}}, "cveMetadata": {"cveId": "CVE-2026-35173", "state": "PUBLISHED", "dateUpdated": "2026-04-06T18:47:56.696Z", "dateReserved": "2026-04-01T17:26:21.133Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-06T17:48:52.681Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "chyrp-lite", "vendor": "xenocrat", "versions": [{"status": "affected", "version": "< 2026.01"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:chyrplite:chyrp_lite:*:*:*:*:*:*:*:*", "matchCriteriaId": "A06975FD-D52C-42B2-8842-7626FCA5A94E", "versionEndExcluding": "2026.01", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Chyrp Lite is an ultra-lightweight blogging engine. Prior to 2026.01, an IDOR / Mass Assignment issue exists in the Post model that allows authenticated users with post editing permissions (Edit Post, Edit Draft, Edit Own Post, Edit Own Draft) to modify posts they do not own and do not have permission to edit. By passing internal class properties such as id into the post_attributes payload, an attacker can alter the object being instantiated. As a result, further actions are performed on another user\u2019s post rather than the attacker\u2019s own post, effectively enabling post takeover. This vulnerability is fixed in 2026.01."}, {"lang": "es", "value": "Chyrp Lite es un motor de blogs ultraligero. Antes de 2026.01, existe un problema de IDOR / Asignaci\u00f3n Masiva en el modelo Post que permite a usuarios autenticados con permisos de edici\u00f3n de publicaciones (Edit Post, Edit Draft, Edit Own Post, Edit Own Draft) modificar publicaciones que no les pertenecen y para las que no tienen permiso de edici\u00f3n. Al pasar propiedades de clase internas como id en la carga \u00fatil post_attributes, un atacante puede alterar el objeto que se est\u00e1 instanciando. Como resultado, se realizan acciones adicionales en la publicaci\u00f3n de otro usuario en lugar de la propia publicaci\u00f3n del atacante, lo que permite efectivamente la toma de control de la publicaci\u00f3n. Esta vulnerabilidad se corrigi\u00f3 en 2026.01."}], "id": "CVE-2026-35173", "lastModified": "2026-07-24T21:10:00.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35173", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-06T18:47:45.411194Z", "version": "2.0.3"}}]}, "published": "2026-04-06T18:16:43.523", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/xenocrat/chyrp-lite/security/advisories/GHSA-8c3h-rh2j-fxr9"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}, {"lang": "en", "value": "CWE-914"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2026.01)"}}], "enrichment": {"confidence": 83.0, "confidence_source": "matching", "scores": [{"score": 83.0, "source": "matching"}]}, "original": {"product": "chyrp-lite", "source": "cna", "vendor": "xenocrat"}, "product": "chyrp-lite", "vendor": "xenocrat_project"}], "analysis": {"en": {"generated_at": "2026-04-14T16:32:53.889938+00:00", "value": {"mitigation_remediation": ["Upgrade Chyrp Lite to 2026.01 or newer", "Verify that only authorized users have Edit Post permissions", "Audit logs for unexpected edit activity"], "summary": {"action": "Apply Patch", "impact": "Post Takeover via Mass Assignment"}, "threat_synthesis": {"affected_systems": "The issue is present in all releases of Xenocrat\u2019s Chyrp Lite before the 2026.01 update. Any deployment that includes versions from the original release up to, but not including, 2026.01 is affected, as identified by the generic CPE identifier cpe:2.3:a:chyrplite:chyrp_lite:*:*:*:*:*:*:*:*.", "description_and_impact": "Chyrp Lite, an ultra\u2011lightweight blogging engine, contains an IDOR that is exploitable through mass assignment in the Post model. Authenticated users who have any post\u2011editing privilege can pass internal class properties such as the post id in the post_attributes payload. When supplied, the framework instantiates the target post instead of the user\u2019s own, allowing the attacker to modify or delete content belonging to another user. This flaw effectively results in post takeover and loss of content integrity.", "risk_and_exploitability": "The CVSS score of 6.5 classifies the vulnerability as medium severity, but the EPSS probability is below 1%, indicating a low likelihood of widespread exploitation. The flaw is only reachable to users who can authenticate and possess post editing permissions, so attackers would need valid credentials. The flaw is not listed in the CISA KEV catalog, further suggesting that no publicly known exploits are actively targeting this weakness."}}}}, "created": "2026-04-07T06:54:51.419045+00:00", "updated": "2026-04-14T16:41:13.124327+00:00", "vendors": ["xenocrat_project", "xenocrat_project$PRODUCT$chyrp-lite"]}