Logchimp
Monthly
Authorization bypass in LogChimp 0.9.0-alpha.1 through 0.9.2 allows authenticated post authors to overwrite other users' post title, slug, content, boardId and roadmap_id by sending a PATCH /api/v1/posts request with mismatched postId and id body parameters. The attacker sets postId to a post they own to pass the ownership check and id to an enumerated victim post UUID, which pre-fix was used as the actual update target; there is no confidentiality impact. The vendor fixed this in v0.9.3, no public exploit was identified at the time of analysis, and the priority is this_week - a genuine but not emergency-grade risk.
Authorization bypass in LogChimp 0.9.0-alpha.1 through 0.9.2 allows authenticated post authors to overwrite other users' post title, slug, content, boardId and roadmap_id by sending a PATCH /api/v1/posts request with mismatched postId and id body parameters. The attacker sets postId to a post they own to pass the ownership check and id to an enumerated victim post UUID, which pre-fix was used as the actual update target; there is no confidentiality impact. The vendor fixed this in v0.9.3, no public exploit was identified at the time of analysis, and the priority is this_week - a genuine but not emergency-grade risk.