Chyrp Lite, an ultra‑lightweight blogging engine, contains an IDOR that is exploitable through mass assignment in the Post model. Authenticated users who have any post‑editing privilege can pass internal class properties such as the post id in the post_attributes payload. When supplied, the framework instantiates the target post instead of the user’s own, allowing the attacker to modify or delete content belonging to another user. This flaw effectively results in post takeover and loss of content integrity.

The issue is present in all releases of Xenocrat’s Chyrp Lite before the 2026.01 update. Any deployment that includes versions from the original release up to, but not including, 2026.01 is affected, as identified by the generic CPE identifier cpe:2.3:a:chyrplite:chyrp_lite:*:*:*:*:*:*:*:*.

The CVSS score of 6.5 classifies the vulnerability as medium severity, but the EPSS probability is below 1%, indicating a low likelihood of widespread exploitation. The flaw is only reachable to users who can authenticate and possess post editing permissions, so attackers would need valid credentials. The flaw is not listed in the CISA KEV catalog, further suggesting that no publicly known exploits are actively targeting this weakness.