LogChimp authorization bypass lets authors overwrite other users' posts

Summary

An authorization flaw in LogChimp lets an authenticated post author change request values and overwrite another person's post title, content, board, and roadmap. Versions from 0.9.0-alpha.1 up to, but not including, 0.9.3 are affected.

Affected when

• Authenticated post author account
• LogChimp 0.9.0-alpha.1 or later, before 0.9.3

What to do

Update to LogChimp v0.9.4. The release notes say the v0.9.3 Docker image is not available.

Products and platforms

• logchimp

CVE IDs

• CVE-2026-121560 (opens in a new tab)

Sources

• Advisory: github.com (opens in a new tab)
• Write-up: github.com (opens in a new tab) · github.com (opens in a new tab) · vulncheck.com (opens in a new tab)
• CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-03 15:17 UTC

First seen 2026-11-09 14:50 UTC