The vulnerability is an authorization bypass that allows authenticated users to update any post by providing a mismatched postId and id in the request body. This flaw enables attackers to alter a victim’s title, slug, content, boardId, or roadmap_id without permission, effectively compromising data integrity of other users’ posts.

The flaw exists in LogChimp versions 0.9.0‑alpha.1 through 0.9.2, inclusive. The affected product is LogChimp, the open‑source blogging platform.

The CVSS score of 7.1 indicates a moderate‑to‑high severity, while the EPSS score is not available, so the likelihood of exploitation is uncertain. The vulnerability is not listed in CISA’s KEV catalog. A legitimate, authenticated user can exploit the flaw by sending a PATCH request to /api/v1/posts with the postId set to their own post and the id set to the victim’s post UUID. Knowledge of the victim’s UUID is required, but it can be discovered through enumeration or other application endpoints, so the attack does not need elevated privileges beyond normal user access. Given the lack of public exploit releases, the immediate risk depends on the number of active users and whether application logs are monitored for suspicious PATCH operations.