Quick answers
- Is CVE-2026-72709 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-72709 being exploited in the wild.
- How severe is CVE-2026-72709?
- Critical severity, with a CVSS score of 9.8, published 11 September 2026.
- Which products and versions are affected?
- Spip before 4.4.18.
- Is there a fix for CVE-2026-72709?
- A patch was published on 2026-08-10: SPIP 4.4.18 released with authorization fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-72709 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-72709?
- Check whether you run Spip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This vulnerability is a missing authorization flaw in SPIP's action handlers under ecrire/action/, specifically in functions like editer_auteur. Attackers can invoke privileged actions by supplying only a valid CSRF nonce without server-side permission checks; template-level authorization guards can be bypassed through direct HTTP requests. The attack is unauthenticated and network-reachable. An attacker can invoke arbitrary actions such as password resets on any account, including administrators, resulting in full account takeover. The vulnerability is fixed in SPIP 4.4.18 through added authorization checks in auteur_instituer() and POST-based action deprecation with explicit authorization.
Affected products
- SPIP SPIP before 4.4.18
Timeline
- 2026-09-11: disclosed: CVE-2026-72709 published; Lexfo blog post describes exploitation chain
- 2026-08-10: patched: SPIP 4.4.18 released with authorization fixes