CVE-2026-72709

SPIP < 4.4.18 Missing Authorization via ecrire/action/

No known exploitation. EPSS puts it in the 49th percentile. No fix published yet.

CVSS 3.19.8Critical EPSS percentile49th0.7% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-09-11Updated 2026-09-15Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check the SPIP version installed on each website and identify any version before 4.4.18.
Upgrade SPIP to version 4.4.18.
After upgrading, review administrator accounts and reset passwords for any account you do not recognize.

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

SPIP before version 4.4.18 contains a missing authorization vulnerability in sensitive actions under ecrire/action/ that allows unauthenticated attackers to invoke privileged actions by supplying only a valid CSRF nonce without any server-side permission check. Attackers can bypass template-level authorization guards through direct HTTP requests to invoke actions such as editer_auteur, enabling arbitrary account password rewrites including administrator accounts and resulting in full account takeover.

In plain language

Written by AI from the record

SPIP versions before 4.4.18 have a serious access-control flaw that can let an attacker take over site accounts, so small businesses using SPIP should update.

Missing server-side authorization in SPIP ecrire/action/ permits direct invocation of privileged actions with a valid CSRF nonce, including administrator password rewrites.

If you're affected

Administrator account takeover
Website content changes
Customer data exposure
Service disruption

What is it

This flaw is like a staff-only control panel whose important buttons can be reached through an unguarded side entrance. An attacker may be able to change an administrator's password and take control of the website.

Who is affected

This matters to you if you run SPIP for a website or internal publishing system. It is a risk when an untrusted person can send direct web requests to the SPIP site.

How urgent is it

An attacker may be able to take over privileged SPIP accounts through a direct request, making this an important update to schedule promptly. There is no record of confirmed active exploitation or public exploit code, so this is an amber priority rather than an emergency incident by itself.

What to do — in detail

Inventory SPIP instances and confirm their installed versions; every release before 4.4.18 is affected.
Upgrade each affected instance to SPIP 4.4.18, following your normal backup, staging, and rollback process.
Test site administration and publishing functions after the upgrade, particularly workflows that use ecrire/action/.
If upgrading must wait, restrict access to the affected administrative action path to trusted administrator networks or a VPN where operationally feasible; test carefully because this may affect administrative workflows.
Review web-server and SPIP logs for unexpected requests to ecrire/action/, especially editer_auteur, and investigate administrator password changes or unfamiliar administrator accounts. CISA has not assigned a KEV remediation due date because this CVE is not listed in KEV.

Technical context

CVE-2026-72709 is CVSS 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-862, missing authorization. In SPIP before 4.4.18, sensitive ecrire/action/ handlers lack a server-side permission check; a direct request with a valid CSRF nonce can invoke privileged actions such as editer_auteur, enabling account password rewrites and administrator takeover. It is not listed in CISA KEV, no public exploit code is recorded, and EPSS is 0.4% with a flat trend. Press attention is rising but is not evidence of exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS49th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.7% chance of exploitation activity in the next 30 days, which ranks it in the 49th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

6 events over 7 days, from the signal feeds we watch.

2026-09-18OpenVAS check added
2026-09-15Record updated
2026-09-11Publishedweakness classified, att&ck mapped, record updated

Affected products

SPIPoss-project · FR
- SPIPWeb AppOn-premWeb & CMS Plugins / cms-core

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable