the administrative action endpoints under has an access control flaw

Published September 11, 2026 CVE-2026-72709

A remote attacker can reset any SPIP account password without logging in. This includes the administrator's password.

Severity
CriticalCVSS 3.1 · 9.8 · vulncheck.com
Fix
Fixed in 4.4.18
Affected versions
before 4.4.18
Weakness
CWE-862Missing Authorization
Affects
SPIP
Exploited
Not confirmedPublic proof of concept, per CISA SSVC
CISA SSVC
Proof of concept publicAutomatable: yes · Technical impact: total
EU ID
EUVD-2026-76155ENISA vulnerability database

How it works

  • An unauthenticated attacker first obtains a valid request signature from SPIP.
  • The attacker can calculate a valid signature for an administrative request.
  • SPIP accepts that request without checking whether the visitor has permission.
  • The attacker can then reset any user's password, including an administrator's.

What to do

If you manage a SPIP site, compare its installed version with 4.4.18 using your deployment records or hosting tools. Treat any version below 4.4.18 as affected by this flaw.

Update every affected SPIP site to version 4.4.18 or later. Confirm the deployed version is 4.4.18 or later after updating.

Technical details

CVE-2026-72709 affects SPIP versions older than 4.4.18. The ecrire/action administrative endpoints accept a valid HMAC-SHA256 nonce without performing the required server-side authorization check. An unauthenticated attacker can compute the nonce for the editer_auteur action. This permits password resets for any account, including administrators.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source