CVE-2026-72709

COMPONENT VERSION RANGE

NewScan fingerprints SPIP from its response and reports this CVE when the detected version falls inside the affected range below.

Added 2026-09-12. CVSS 9.3 (v4) / 9.8 (v3.1). The action endpoints under ecrire/action/ verify the HMAC-SHA256 nonce and then never call autoriser(), so a nonce an ANONYMOUS caller can compute is treated as authorization: invoke editer_auteur directly over HTTP and reset the administrator's password. Link 2 of the Lexfo chain (blog.lexfo.fr/casse-spip-sqli-to-rce.html) - CVE-2026-72708 leaks the alea_ephemere signing secret, this row forges the nonce, CVE-2026-72710 turns it into RCE. Same `ge 4.4.0` lower bound and same reason as the two rows above: NVD says only `before 4.4.18` with no branch qualifier while SPIP backports on 4.1/4.2/4.3 in parallel, so an unbounded `lt` would call a patched 4.3.x vulnerable. Three separate rows rather than one merged row because each CVE is a distinct bug an assessor has to be able to look up by id - they do share the 4.4.18 fix train, so a 4.4.17 install reports all three; all three are true and all three resolve to the same upgrade (the CVE-2026-77806 row above already settled that trade). Version-match only: proving any link of this chain means resetting a customer's admin password. Reachable through the SPIP tech_signatures rows, which read the release from GET /CHANGELOG.md; what was re-measured live on 2026-09-12 is the VERSION READ - a running ipeos/spip answered GET /CHANGELOG.md with `## 4.4.21 - 2026-08-20` and the live fingerprint tool recorded SPIP 4.4.21 with no findings. 4.4.21 is above this row's `lt 4.4.18`, so the container is the PATCHED arm; the affected arm is a fixture case in tests/integration/tech_version_from_checks.py, which pins both sides of 4.4.18.