Chyrp Lite EUVD-2026-19420

Chyrp Lite's Post model contains a mass assignment flaw where user-controlled input from the post_attributes payload is insufficiently validated before instantiating or modifying Post objects. The vulnerability stems from CWE-639 (Authorization Through User-Controlled Key), where internal object identifiers (such as the post ID) are accessible to authenticated users and can be manipulated to reference posts outside the attacker's authorized scope. In typical Ruby on Rails or similar MVC frameworks, mass assignment occurs when framework methods blindly assign all incoming request parameters to model attributes without explicitly whitelisting permitted fields. An authenticated attacker with Edit Post, Edit Draft, Edit Own Post, or Edit Own Draft permissions can bypass authorization checks by directly specifying the ID or other identifying attributes of a target post, causing subsequent operations (updates, deletes, or state changes) to be performed on the victim's post rather than the attacker's own.