CVE-2026-72709

SPIP before 4.4.18 contains a missing authorization flaw (CWE-862) in the administrative action endpoints under ecrire/action/, where actions are validated only by an HMAC-SHA256 nonce and never checked server-side with the autoriser() permission function. An unauthenticated attacker can obtain a valid nonce, compute it for any action as the anonymous user, and invoke the editer_auteur action directly over HTTP. This allows the attacker to reset the password of any user account, including the administrator, leading to full account and site takeover. All SPIP deployments running a version earlier than 4.4.18 are affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is currently known, but the flaw carries a critical CVSS 4.0 score of 9.3 and is trivially triggerable over the network without privileges or user interaction.

What to do: Upgrade SPIP to version 4.4.18 or later as soon as possible. As interim mitigation, restrict HTTP access to the ecrire/action/ endpoints and monitor for unexpected password-reset emails or administrator logins; if a reset is observed, rotate administrator credentials immediately and check for unauthorized changes.