GHSA-px65-33x4-mwqqCriticalCVSS 9.8
SPIP before 4.4.18 contains a missing authorization vulnerability in the administrative action...
🔗 CVE IDs covered (1)
📋 Description
SPIP before 4.4.18 contains a missing authorization vulnerability in the administrative action endpoints under ecrire/action/ that allows unauthenticated attackers to perform privileged actions by supplying a valid HMAC-SHA256 nonce without any server-side permission check via autoriser(). Attackers can obtain a valid nonce, compute it for any action as the anonymous user, and invoke the editer_auteur action directly over HTTP to reset the password of any user account, including the administrator.
🔗 References (5)
- https://nvd.nist.gov/vuln/detail/CVE-2026-72709
- https://blog.lexfo.fr/casse-spip-sqli-to-rce.html
- https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-4-18.html
- https://www.vulncheck.com/advisories/spip-missing-authorization-via-ecrire-action-editer-auteur
- https://github.com/advisories/GHSA-px65-33x4-mwqq