CVE-2026-72709 — SPIP < 4.4.18 Missing Authorization via ecrire/action/
SPIP before version 4.4.18 contains a missing authorization vulnerability in sensitive actions under ecrire/action/ that allows unauthenticated attackers to invoke privileged ac…
Published: 2026-09-11 · CVSS: 9.3 · CVSS 4.0
SPIP before version 4.4.18 contains a missing authorization vulnerability in sensitive actions under ecrire/action/ that allows unauthenticated attackers to invoke privileged actions by supplying only a valid CSRF nonce without any server-side permission check. Attackers can bypass template-level authorization guards through direct HTTP requests to invoke actions such as editer_auteur, enabling arbitrary account password rewrites including administrator accounts and resulting in full account takeover.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7