# CVE-2026-72709: SPIP missing authorization in sensitive actions

Source: https://junglewise.ai/threats/cve-2026-72709-spip-missing-authorization-in-sensitive-actions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-11. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-72709 · Severity: critical · CVSS 9.8 · Published 2026-09-11

SPIP is a French open-source content management system used by institutional, media, and community websites. This vulnerability allows unauthenticated attackers to bypass authorization controls and perform privileged administrative actions, including resetting administrator passwords and gaining full account takeover without requiring valid credentials.

Technologies: [Spip](https://junglewise.ai/threats/technologies/spip). Vendors: [Spip](https://junglewise.ai/threats/vendors/spip).

## Quick answers

**Is CVE-2026-72709 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-72709 being exploited in the wild.

**How severe is CVE-2026-72709?** Critical severity, with a CVSS score of 9.8, published 11 September 2026.

**Which products and versions are affected?** Spip before 4.4.18.

**Is there a fix for CVE-2026-72709?** A patch was published on 2026-08-10: SPIP 4.4.18 released with authorization fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-72709 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-72709?** Check whether you run Spip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a missing authorization flaw in SPIP's action handlers under ecrire/action/, specifically in functions like editer_auteur. Attackers can invoke privileged actions by supplying only a valid CSRF nonce without server-side permission checks; template-level authorization guards can be bypassed through direct HTTP requests. The attack is unauthenticated and network-reachable. An attacker can invoke arbitrary actions such as password resets on any account, including administrators, resulting in full account takeover. The vulnerability is fixed in SPIP 4.4.18 through added authorization checks in auteur_instituer() and POST-based action deprecation with explicit authorization.

## Affected products

- SPIP SPIP before 4.4.18

## Timeline

- 2026-09-11: disclosed: CVE-2026-72709 published; Lexfo blog post describes exploitation chain
- 2026-08-10: patched: SPIP 4.4.18 released with authorization fixes

## References

- [https://blog.lexfo.fr/casse-spip-sqli-to-rce.html](https://blog.lexfo.fr/casse-spip-sqli-to-rce.html)
- [https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-4-18.html](https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-4-18.html)

## Related threats

- [SPIP SQL injection via parameter mismatch](https://junglewise.ai/threats/cve-2026-122032-spip-before-4-4-29-contains-a-sql-injection-vulnerability-that)
- [SPIP server-side request forgery in recuperer_url()](https://junglewise.ai/threats/cve-2026-109378-spip-before-4-4-18-contains-a-server-side-request-forgery)
- [SPIP mass assignment in editer_objet leading to RCE](https://junglewise.ai/threats/cve-2026-72710-spip-mass-assignment-in-editer-objet-leading-to-rce)
- [SPIP unauthenticated blind SQL injection in SQL escaping](https://junglewise.ai/threats/cve-2026-72708-spip-unauthenticated-blind-sql-injection-in-sql-escaping)
- [SPIP code injection in X-Spip-Filtre header](https://junglewise.ai/threats/cve-2026-77806-spip-code-injection-in-x-spip-filtre-header)