Improper Access Control in Atlas-Livre Admin Controllers

CVE-2026-69703

What is CVE-2026-69703?

Atlas-Livre exhibits an improper access control vulnerability within its admin controllers located under Espace_admin/controleur/. This flaw permits unauthenticated attackers to circumvent session-based authentication protections through the manipulation of raw HTTP requests that do not comply with the necessary redirects. Specifically, by targeting vulnerable controller endpoints with specific GET parameters, attackers can invoke critical administrative functions such as record deletion. The absence of an exit or die call following the PHP header() redirect results in the execution of subsequent code, including database manipulation, independent of the user’s session state.

References