CVE-2025-71242
Received
Received - Intake
Unauthorized Content Disclosure in SPIP AJAX Fragments Before
Vulnerability report for CVE-2025-71242, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-02-19
Last updated on: 2026-03-02
Assigner: VulnCheck
Description
Description
SPIP before 4.3.6, 4.2.17, and 4.1.20 allows unauthorized content disclosure in the private area. The application does not properly check authorization when displaying content of articles and sections (rubriques) in AJAX-loaded fragments, allowing an authenticated attacker to access restricted content. This vulnerability is not mitigated by the SPIP security screen.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| spip | spip | From 4.1.0 (inc) to 4.1.20 (exc) |
| spip | spip | From 4.2.0 (inc) to 4.2.17 (exc) |
| spip | spip | From 4.3.0 (inc) to 4.3.6 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
