CVE-2026-72709

Deferred Deferred - Pending Action

SPIP Missing Authorization in Admin Action Endpoints

Publication date: 2026-09-11

Last updated on: 2026-09-15

Assigner: VulnCheck

Description

SPIP before version 4.4.18 contains a missing authorization vulnerability in sensitive actions under ecrire/action/ that allows unauthenticated attackers to invoke privileged actions by supplying only a valid CSRF nonce without any server-side permission check. Attackers can bypass template-level authorization guards through direct HTTP requests to invoke actions such as editer_auteur, enabling arbitrary account password rewrites including administrator accounts and resulting in full account takeover.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-15

Generated

2026-10-02

AI Q&A

2026-09-11

EPSS Evaluated

2026-09-30

NVD

CVE-2026-72709

EUVD

EUVD-2026-76155

Affected Vendors & Products

Vendor	Product	Version / Range
spip	spip	to 4.4.18 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

SPIP before version 4.4.18 has a missing authorization vulnerability in administrative action endpoints under ecrire/action/. Unauthenticated attackers can exploit a valid HMAC-SHA256 nonce to perform privileged actions without server-side permission checks. The vulnerability affects the autoriser() function, allowing attackers to reset passwords of any user account, including administrators, by invoking the editer_auteur action directly over HTTP.

Detection Guidance

To detect this vulnerability, check if your SPIP instance is running a version before 4.4.18. Inspect network traffic for HTTP requests to paths under /ecrire/action/, particularly targeting the editer_auteur endpoint. Verify if unauthenticated requests can trigger privileged actions like password resets.

Impact Analysis

This vulnerability allows unauthenticated attackers to reset passwords of any user account, including administrators, leading to full system compromise. Attackers can gain complete control over the SPIP instance, access sensitive data, and perform unauthorized actions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA compliance requirements. It may result in data breaches, unauthorized disclosure of personal or health information, and failure to maintain data integrity and confidentiality.

Mitigation Strategies

Immediately upgrade SPIP to version 4.4.18 or later to address the missing authorization vulnerability in the administrative action endpoints.

Hi! I’m here to help you understand CVE-2026-72709. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70