CVE-2026-35173: Chyrp Lite Auth Bypass Vulnerability

CVE-2026-35173 Overview

CVE-2026-35173 is an Insecure Direct Object Reference (IDOR) and Mass Assignment vulnerability affecting Chyrp Lite, an ultra-lightweight blogging engine. Prior to version 2026.01, the Post model improperly allows authenticated users with post editing permissions (Edit Post, Edit Draft, Edit Own Post, Edit Own Draft) to modify posts they do not own and do not have permission to edit. By passing internal class properties such as id into the post_attributes payload, an attacker can alter the object being instantiated, enabling unauthorized post takeover.

Critical Impact

Authenticated attackers with limited post editing privileges can modify or take over any post in the system, potentially leading to unauthorized content manipulation, defacement, or data integrity compromise.

Affected Products

• Chyrp Lite versions prior to 2026.01

Discovery Timeline

• 2026-04-06 - CVE CVE-2026-35173 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-35173

Vulnerability Analysis

This vulnerability represents a classic combination of Insecure Direct Object Reference (IDOR) and Mass Assignment flaws (CWE-639). The Post model in Chyrp Lite fails to properly validate user authorization against the specific post being modified. When processing edit requests, the application accepts user-controlled parameters that directly influence which database object is targeted for modification.

The vulnerability allows authenticated users to manipulate internal object properties through the post_attributes payload. By injecting properties like id into the request, attackers can redirect the editing operation to target a different post than intended, effectively bypassing ownership and permission checks.

Root Cause

The root cause lies in improper authorization verification within the Post model. The application trusts user-supplied data to determine which post object should be instantiated and modified, rather than enforcing strict ownership validation at the model level. This allows mass assignment of protected attributes including the object identifier, enabling attackers to reference arbitrary posts regardless of ownership.

Attack Vector

The attack requires network access and authentication with at least one of the following permissions: Edit Post, Edit Draft, Edit Own Post, or Edit Own Draft. An attacker crafts a malicious POST request to the post editing endpoint, including the id parameter of a target post they wish to compromise within the post_attributes payload. The vulnerable code instantiates a Post object using the attacker-supplied id rather than the legitimate post identifier, causing subsequent operations to affect the victim's post.

The exploitation flow involves:

1. Authenticating with an account that has minimal post editing privileges
2. Initiating a legitimate edit request for a post the attacker owns
3. Injecting the id of a victim's post into the post_attributes payload
4. The Post model instantiates using the victim's post ID
5. Edit operations are applied to the victim's post instead of the attacker's post

For detailed technical information and proof-of-concept details, see the GitHub Security Advisory.

Detection Methods for CVE-2026-35173

Indicators of Compromise

• Unexpected modifications to blog posts by users who should not have edit permissions for those specific posts
• Web server logs showing POST requests to editing endpoints with unusual or duplicated id parameters in the payload
• Audit log entries indicating post modifications where the editing user differs from the post owner without administrative privileges

Detection Strategies

• Implement logging and alerting for post edit operations where the authenticated user's ID does not match the post owner's ID
• Monitor HTTP POST requests to post editing endpoints for anomalous id parameters within the request body
• Review access logs for patterns of authenticated users editing posts belonging to other users
• Deploy Web Application Firewall (WAF) rules to detect mass assignment attempts in POST payloads

Monitoring Recommendations

• Enable verbose logging on the Chyrp Lite application to capture all post modification events with user context
• Configure SIEM alerts for authorization bypass patterns in web application logs
• Regularly audit post ownership and modification history for unauthorized changes

How to Mitigate CVE-2026-35173

Immediate Actions Required

• Upgrade Chyrp Lite to version 2026.01 or later immediately
• Review all posts for unauthorized modifications that may have occurred prior to patching
• Audit user accounts with post editing permissions to ensure appropriate access levels
• Consider temporarily revoking Edit Post/Draft permissions for non-administrative users until the patch is applied

Patch Information

This vulnerability is fixed in Chyrp Lite version 2026.01. The patch addresses the IDOR and Mass Assignment issue by implementing proper authorization checks in the Post model to ensure users can only modify posts they own or have explicit permission to edit. For more details, refer to the GitHub Security Advisory.

Workarounds

• If immediate upgrading is not possible, restrict post editing permissions to only trusted administrative users
• Implement additional server-side validation at the web server or reverse proxy level to strip id parameters from post_attributes payloads
• Consider deploying a WAF rule to block POST requests containing suspicious mass assignment patterns targeting the post editing endpoint
• Monitor the application closely for signs of exploitation while working toward upgrading

# Example: Upgrade Chyrp Lite to patched version
cd /var/www/chyrp-lite
git fetch --tags
git checkout 2026.01