Lagarto Chivato: Uncontrolled resource consumption in publicar_aviso function

Summary

Lagarto Chivato, a web application, does not limit how many notices an authenticated user can submit through the publicar_aviso function. There is no rate limiting, per-account quota or validation of geographic coordinates. An attacker with a valid low-privilege account can flood the moderation queue, with the advisory reporting up to 233 notices per minute from a single account. The impact is limited to availability of the moderation process (CVSS 3.1 4.3, Medium).

Affected

• Lagarto Chivato 0.1.0 to 0.4.1 (CVE record)
• Versions 0.4.2 and 0.4.3: status unclear, as VulDB gives a different range (up to 0.4.1/0.4.3)

Fixed in

• Upgrade to version 0.4.4 (CVE record and VulDB)

Workaround

Unknown. No vendor workaround was found in the sources.

• Interim measures (not from a source): restrict account creation, review or disable self-registration, monitor the moderation queue for floods, and limit web interface access to trusted users until the upgrade is applied.

Exploitation

• VulDB: technical details are known, but no exploit is available
• OffSeq: not known to be exploited
• No public proof of concept, in-the-wild exploitation or CISA KEV listing found at the time of writing

Our recommendation

• Check whether any client runs Lagarto Chivato and which version
• Upgrade affected installations to 0.4.4 in the normal patch cycle; prioritise platforms that are public-facing with open registration
• Until then, restrict or review self-registration and monitor the moderation queue for unusual submission volumes
• Watch the vendor advisory, NVD and CISA for updates

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE Record CVE-2026-126784 www.cve.org
• VulDB vulnerability 435975 vuldb.com
• OffSeq threat radar entry radar.offseq.com
• CVE Threatint mirror cve.threatint.com
• Grayback security advisories (Spanish) www.grayback.es
• Grayback security advisories (English) www.grayback.es

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 21:25.