Executive brief
SPIP is a French open-source content management system used by institutional, media, and community websites. This vulnerability allows unauthenticated attackers to bypass authorization controls and perform privileged administrative actions, including resetting administrator passwords and gaining full account takeover without requiring valid credentials.
Technical details
This vulnerability is a missing authorization flaw in SPIP's action handlers under ecrire/action/, specifically in functions like editer_auteur. Attackers can invoke privileged actions by supplying only a valid CSRF nonce without server-side permission checks; template-level authorization guards can be bypassed through direct HTTP requests. The attack is unauthenticated and network-reachable. An attacker can invoke arbitrary actions such as password resets on any account, including administrators, resulting in full account takeover. The vulnerability is fixed in SPIP 4.4.18 through added authorization checks in auteur_instituer() and POST-based action deprecation with explicit authorization.
Affected products
- SPIP SPIP before 4.4.18
Timeline
- 2026-09-11: disclosed: CVE-2026-72709 published; Lexfo blog post describes exploitation chain
- 2026-08-10: patched: SPIP 4.4.18 released with authorization fixes