This vulnerability enables an authenticated user with any post editing permission to modify content that belongs to other users. By including internal class properties such as the post ID in a post_attributes payload, the attacker can instantiate a Post object that references another user's entry, effectively taking over that content through a typical IDOR combined with mass assignment.

The issue impacts Chyrp Lite from xenocrat. Any installation running a version before 2026.01 is vulnerable, while releases from 2026.01 onward contain the fix.

The CVSS score of 6.5 indicates moderate severity. Because the flaw requires the attacker to be an authenticated user with post editing rights, the attack scope is limited to users who can edit content. No publicly disclosed exploits exist, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. Exploitation is straightforward for users with the necessary permissions: they can craft a payload that includes the target post ID, override the binding, and repurpose the content. Preventive measures involve upgrading to the patched version or restricting edit privileges for untrusted users.