Missing Authorization Vulnerability in SPIP Product by SPIP
CVE-2026-72709

9.3CRITICAL

Key Information:

Vendor

Spip

Status
Spip
Vendor
CVE Published:
11 September 2026

What is CVE-2026-72709?

The missing authorization vulnerability in SPIP versions prior to 4.4.18 exposes administrative action endpoints to unauthenticated attackers. By generating a valid HMAC-SHA256 nonce, attackers can bypass server-side permission checks, allowing them to invoke critical actions such as password resets for any user account, including administrators. This flaw can lead to unauthorized access and potential account takeovers, highlighting the need for an immediate update to the latest secure version to mitigate risks.

Affected Version(s)

SPIP 0 < 4.4.18

References

https://blog.lexfo.fr/casse-spip-sqli-to-rce.html
technical-descriptionexploit
https://blog.spip.net/Mise-a-jour-critique-de-securite-so...
release-notespatch
https://www.vulncheck.com/advisories/spip-missing-authori...
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Franck Chevalier
Wayko
.