CVE-2026-126784

MEDIUM 4.3

Uncontrolled resource consumption via post_notice

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

Missing rate limiting, per-account submission quota and geographic validation in the publicar_aviso RPC function in Lagarto Chivato 0.4.1 and earlier on Web allows remote authenticated attackers to flood the moderation queue via unlimited submission of notices with arbitrary coordinates.

CWE	CWE-770
Vendor	xauendevs
Product	lagarto chivato
Published	Nov 11, 2026

Stay Ahead of the Next One

Get instant alerts for xauendevs lagarto chivato

Be the first to know when new medium vulnerabilities affecting xauendevs lagarto chivato are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Affected Versions

XauenDevs / Lagarto Chivato

0.1.0 ≤ 0.4.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

grayback.es: https://www.grayback.es/advisories grayback.es: https://www.grayback.es/en/advisories

Credits

m1w34p0n