CVE-2026-126784: Uncontrolled resource consumption via post_notice
Missing rate limiting, per-account submission quota and geographic validation in the publicaraviso RPC function in Lagarto Chivato 0.4.1 and earlier on Web allows remote authenticated attackers to flood the moderation queue via unlimited submission of notices with arbitrary coordinates.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Web deployments of Lagarto Chivato version 0.4.1 and earlier are affected where authenticated users can access the publicar_aviso RPC function. An attacker needs a valid account but does not need user interaction.
What can an attacker do?
An authenticated remote attacker can submit unlimited notices with arbitrary coordinates, flooding the moderation queue. The stated impact is reduced availability rather than confidentiality or integrity loss.
What can be done if patching is not immediately possible?
Apply rate limiting and per-account submission quotas to notice creation, and validate submitted geographic coordinates. Monitoring moderation-queue volume and repeated submissions by individual accounts can help identify active abuse.