CVE-2026-69703
Received Received - Intake

Improper Access Control in Atlas-Livre Admin Controllers

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: VulnCheck

Description
Atlas-Livre contains an improper access control vulnerability in the admin controllers under Espace_admin/controleur/ that allows unauthenticated attackers to bypass session-based authentication guards by sending raw HTTP requests that ignore redirects. Attackers can invoke destructive admin actions such as record deletion by requesting controller endpoints with GET parameters like supp, because the PHP header() redirect is never followed by an exit or die call, allowing all subsequent code including database operations to execute regardless of session state.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-69703
EUVD
EUVD-2026-52866

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
maximeamini atals-livre *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Atlas-Livre has an improper access control flaw in admin controllers. Unauthenticated attackers can bypass session-based authentication by sending raw HTTP requests that ignore redirects. The PHP header() redirect does not include exit or die calls, so destructive actions like record deletion can be performed by manipulating GET parameters such as 'supp'.

Detection Guidance

Check for unauthorized access to admin endpoints in Atlas-Livre by monitoring HTTP requests to Espace_admin/controleur/ with GET parameters like supp. Look for raw HTTP requests that bypass session checks or redirects.

Impact Analysis

Attackers could delete sensitive admin records, modify data, or disrupt operations without authentication. This could lead to data loss, unauthorized changes, or system compromise depending on the application's use of the affected controllers.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and audit trails, such as GDPR's data protection principles or HIPAA's safeguards for protected health information. Unauthorized data deletion or modification may result in non-compliance penalties.

Mitigation Strategies

Immediately update Atlas-Livre to the latest patched version. If no patch is available, restrict access to admin controllers via firewall rules or disable the vulnerable endpoints until a fix is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-69703. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart