CVE-2026-72709

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.4.18

Description An authorization flaw exists in sensitive actions located under the 'ecrire/action/' endpoint. Unauthenticated attackers can invoke privileged actions by providing a valid CSRF (Cross-Site Request Forgery) nonce—a unique token used to prevent unauthorized requests—without the server performing necessary permission checks. By sending direct HTTP requests, attackers can bypass template-level authorization guards to execute actions such as editer auteur(), allowing them to rewrite passwords for any account, including administrators, leading to full account takeover.

Recommendations Update to version 4.4.18 or later.