CVE-2026-72709
CRITICAL · 9.8 EPSS 0.3%High CVSS and age <24h with claimed public exploit, but no KEV, no independent confirmation, syndication-heavy chatter.
What: SPIP < 4.4.18 missing authorization in ecrire/action/ endpoints allows unauthenticated attackers to reset any user password via forged HMAC-SHA256 nonce without permission checks. CVSS 9.8 CRITICAL.
Why it matters: Published 2026-09-11; social posts claim "public exploit" available. CVSS 9.8 and straightforward auth-bypass primitive (password reset) make this immediately exploitable. Not KEV-listed yet but single-day-old disclosure with widespread automated chatter suggests rapid awareness.
Where it's seen: Automated syndication posts across Bluesky referencing vulnsea and similar feed aggregators; posts repeat identical text with "public exploit" tag. No independent researcher PoC drops, vendor advisory citations, or defender triage questions yet—chatter is feed-driven noise rather than organic security community response.
RISK: CRITICAL — Unauthenticated password reset of any account (CVSS 9.8); simple nonce forgery.
Description
SPIP before 4.4.18 contains a missing authorization vulnerability in the administrative action endpoints under ecrire/action/ that allows unauthenticated attackers to perform privileged actions by supplying a valid HMAC-SHA256 nonce without any server-side permission check via autoriser(). Attackers can obtain a valid nonce, compute it for any action as the anonymous user, and invoke the editer_auteur action directly over HTTP to reset the password of any user account, including the administrator.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Attack vector
- Network
- Complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High