Medium severity6.5NVD Advisory· Published Jul 1, 2024· Updated Jun 17, 2026

CVE-2024-39313

Description

toy-blog is a headless content management system implementation. Starting in version 0.5.4 and prior to version 0.6.1, articles with private visibility can be read if the reader does not set credentials for the request. Users should upgrade to 0.6.1 or later to receive a patch. No known workarounds are available.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Toy Blog Project/Toy Blog
cpe:2.3:a:toy-blog_project:toy-blog:*:*:*:*:*:*:*:*
Range: >=0.5.4,<0.6.1
KisaragiEffective/toy-blogllm-fuzzy2 versions
>=0.5.4,<0.6.1+ 1 more
- (no CPE)range: >=0.5.4,<0.6.1
- (no CPE)range: >= 0.5.4, < 0.6.1

Patches

Vulnerability mechanics

References

github.com/KisaragiEffective/toy-blog/commit/f13a45f68c9560124558e6bb445ad441a4cf4732nvdPatch
github.com/KisaragiEffective/toy-blog/security/advisories/GHSA-rf2q-5q4q-5fwrnvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000