CVE-2026-72709

SPIP < 4.4.18 Missing Authorization via ecrire/action/

Published: Sep 11, 2026Updated: Sep 15, 2026 Sources: CVE List NVDCWE-862

9.8CRITICAL

Description

SPIP before version 4.4.18 contains a missing authorization vulnerability in sensitive actions under ecrire/action/ that allows unauthenticated attackers to invoke privileged actions by supplying only a valid CSRF nonce without any server-side permission check. Attackers can bypass template-level authorization guards through direct HTTP requests to invoke actions such as editer_auteur, enabling arbitrary account password rewrites including administrator accounts and resulting in full account takeover.

In plain language

AI Worth attention

SPIP versions before 4.4.18 have a serious access-control flaw that can let an attacker take over site accounts, so small businesses using SPIP should update.

Executive summary

Missing server-side authorization in SPIP ecrire/action/ permits direct invocation of privileged actions with a valid CSRF nonce, including administrator password rewrites.

If affected, business impact

Administrator account takeoverWebsite content changesCustomer data exposureService disruption

What to do now

Check the SPIP version installed on each website and identify any version before 4.4.18.
Upgrade SPIP to version 4.4.18.
After upgrading, review administrator accounts and reset passwords for any account you do not recognize.

Usually a quick update

What is it

This flaw is like a staff-only control panel whose important buttons can be reached through an unguarded side entrance. An attacker may be able to change an administrator's password and take control of the website.

Who is affected

This matters to you if you run SPIP for a website or internal publishing system. It is a risk when an untrusted person can send direct web requests to the SPIP site.

How urgent is it

An attacker may be able to take over privileged SPIP accounts through a direct request, making this an important update to schedule promptly. There is no record of confirmed active exploitation or public exploit code, so this is an amber priority rather than an emergency incident by itself.

What to do — in detail

Inventory SPIP instances and confirm their installed versions; every release before 4.4.18 is affected.
Upgrade each affected instance to SPIP 4.4.18, following your normal backup, staging, and rollback process.
Test site administration and publishing functions after the upgrade, particularly workflows that use ecrire/action/.
If upgrading must wait, restrict access to the affected administrative action path to trusted administrator networks or a VPN where operationally feasible; test carefully because this may affect administrative workflows.
Review web-server and SPIP logs for unexpected requests to ecrire/action/, especially editer_auteur, and investigate administrator password changes or unfamiliar administrator accounts. CISA has not assigned a KEV remediation due date because this CVE is not listed in KEV.

Technical context

CVE-2026-72709 is CVSS 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-862, missing authorization. In SPIP before 4.4.18, sensitive ecrire/action/ handlers lack a server-side permission check; a direct request with a valid CSRF nonce can invoke privileged actions such as editer_auteur, enabling account password rewrites and administrator takeover. It is not listed in CISA KEV, no public exploit code is recorded, and EPSS is 0.4% with a flat trend. Press attention is rising but is not evidence of exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

CVSS Vector Breakdown

Exploitability

AV:NAttack Vector

Network

AC:LAttack Complexity

Low

PR:NPrivileges Required

None

UI:NUser Interaction

None

Scope

S:UScope

Unchanged

Impact

C:HConfidentiality

High

I:HIntegrity

High

A:HAvailability

High

Open in CVSS calculator →

Weaknesses

CWE-862

Affected Products

SPIP

oss-project·FR

SPIPOn-premWeb App

Web & CMS Plugins / cms-core

Exploitability

No known exploits, KEV entries, or remediation guidance available for this vulnerability yet.

Is your org exposed to CVE-2026-72709?Request an assessment to establish which checks are appropriate for your systems. Check my exposure

Attack Graph

Products CVE Techniques Tactics

Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.

MITRE ATT&CK

2 techniques

Initial Access

View detailed technique mapping

References

https://blog.lexfo.fr/casse-spip-sqli-to-rce.html

blog.lexfo.fr

https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-4-18.html

blog.spip.net

https://www.vulncheck.com/advisories/spip-missing-authorization-via-ecrire-action-editer-auteur

vulncheck.com

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2026-72709 and every CVE in our database. Create a free account — no credit card required.

Create Free Account

Plain-language analysis

Impact assessment and exploitation scenario in plain English

Attack graph visualization

Interactive attack path and kill chain mapping

Exploit details & PoC links

ExploitDB, Metasploit, GitHub PoCs with direct links

Nuclei scanner templates

Ready-to-use vulnerability scanner templates

Full remediation guide

Patch instructions, workarounds, and compliance impact

Interactive AI chat

Ask questions about this vulnerability in natural language

Related vulnerabilities

Semantically similar CVEs and attack patterns

REST API & MCP access

Integrate vulnerability data into your workflows