CVE-2024-39313: toy-blog Improper Input Validation vulnerability

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-07-01 · updated 2026-06-17
Weakness: CWE-200

Description

toy-blog is a headless content management system implementation. Starting in version 0.5.4 and prior to version 0.6.1, articles with private visibility can be read if the reader does not set credentials for the request. Users should upgrade to 0.6.1 or later to receive a patch. No known workarounds are available.

Affected products

KisaragiEffective toy-blog: from 0.5.4 before 0.6.1 — fixed in 0.6.1

How to fix

Upgrade to a fixed version: KisaragiEffective toy-blog 0.6.1. Check the vendor advisory for mitigations.

References

https://github.com/KisaragiEffective/toy-blog/commit/f13a45f68c9560124558e6bb445ad441a4cf4732
https://github.com/KisaragiEffective/toy-blog/security/advisories/GHSA-rf2q-5q4q-5fwr
https://github.com/KisaragiEffective/toy-blog/commit/f13a45f68c9560124558e6bb445ad441a4cf4732
https://github.com/KisaragiEffective/toy-blog/security/advisories/GHSA-rf2q-5q4q-5fwr

Get alerted when CVE-2024-39313 or the next vulnerability affects your stack