CVE-2026-72709
SPIP versions before 4.4.18 have a missing authorization check that lets anyone who can guess a valid HMAC‑SHA256 nonce reset any user’s password. Because the check is missing, attackers can take over any account, including the administrator, without needing to log in. The flaw is easy to exploit over HTTP.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
The vulnerability affects the SPIP content‑management system in all releases older than 4.4.18. Site owners who run those versions are at risk.
Real-world impact
An attacker who can obtain a valid nonce can reset the password of any user, including the administrator, and then log in as that user. This gives the attacker full control over the website, allowing data theft, defacement, or further attacks.
Why this severity
The CVSS score of 9.3 reflects that the flaw has high impact on confidentiality, integrity, and availability, requires no authentication, and can be exploited remotely. Because the attacker can take over any account, the risk is considered critical.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources