CVE-2026-72709: SPIP < 4.4.18 Missing Authorization via ecrire/action/ editer_auteur
SPIP before 4.4.18 contains a missing authorization vulnerability in the administrative action endpoints under ecrire/action/ that allows unauthenticated attackers to perform privileged actions by supplying a valid HMAC-SHA256 nonce without any server-side permission check via autoriser(). Attackers can obtain a valid nonce, compute it for any action as the anonymous user, and invoke the editerauteur action directly over HTTP to reset the password of any user account, including the administrator.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit it. No prior account, user interaction, or elevated privileges are required.
What does an attacker need to carry out the attack?
The attacker needs a valid HMAC-SHA256 nonce. The issue allows an attacker to obtain and compute a nonce for the target action as an anonymous user.
What is the practical impact of successful exploitation?
An attacker can directly invoke the editer_auteur administrative action over HTTP and reset the password of any account, including an administrator account. This can result in administrative account takeover.
Are affected installations vulnerable in their default state?
The provided information identifies affected SPIP versions before 4.4.18 and does not state that any non-default configuration or feature enablement is required. The vulnerable administrative action endpoint is reachable over HTTP.