CRITICAL 9.3 NVD
CVE-2026-72709
SPIP before 4.4.18 contains a missing authorization vulnerability in the administrative action endpoints under ecrire/action/ that allows unauthenticated attack
SPIP before 4.4.18 contains a missing authorization vulnerability in the administrative action endpoints under ecrire/action/ that allows unauthenticated attackers to perform privileged actions by supplying a valid HMAC-SHA256 nonce without any server-side permission check via autoriser(). Attackers can obtain a valid nonce, compute it for any action as the anonymous user, and invoke the editer_auteur action directly over HTTP to reset the password of any user account, including the administrator.
References
- https://blog.lexfo.fr/casse-spip-sqli-to-rce.html
- https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-4-18.html
- https://www.vulncheck.com/advisories/spip-missing-authorization-via-ecrire-action-editer-a
This critical severity vulnerability with a CVSS score of 9.3 was published on 2026-09-11 via NVD.
Risk Timeline
CVE Disclosed2026-09-11 · 0 days ago
Remediation Resources
vulnfeed aggregates 12842 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.