PT-2026-30694 · Unknown · Chyrp Lite

Whoamins · Published 2026-04-06 · Updated 2026-04-06 · CVE-2026-35173

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Chyrp Lite versions prior to 2026.01

Description Chyrp Lite, an ultra-lightweight blogging engine, contains an IDOR / Mass Assignment issue in the Post model. Authenticated users with post editing permissions (Edit Post, Edit Draft, Edit Own Post, Edit Own Draft) can modify posts they do not own or have permission to edit. By manipulating internal class properties like id within the post attributes payload, an attacker can alter the object being instantiated, leading to post takeover by performing actions on another user’s post.

Recommendations Update to version 2026.01 or later.

Fix

IDOR

Weakness Enumeration

CWE-914

CWE-639

Related Identifiers

CVE-2026-35173

Affected Products

Chyrp Lite

References · 3

• https://github.com/xenocrat/chyrp-lite/security/advisories/GHSA-8c3h-rh2j-fxr9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35173 · Security Note
• https://twitter.com/CVEnew/status/2041223945777520816 · Twitter Post