EUVD-2026-14268
GHSA-x592-5gwh-wjg9
Severity by source
AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L
Lifecycle Timeline
4DescriptionCVE.org
SPIP 4.4.10 through 4.4.12 before 4.4.13 allows unintended privilege assignment (of administrator privileges) during the editing of an author data structure because of STATUT mishandling.
AnalysisAI
SPIP versions 4.4.10 through 4.4.12 contain a privilege escalation vulnerability that allows authenticated users with limited permissions to assign administrator privileges to themselves or other accounts through improper handling of the STATUT field during author data structure editing. An attacker with login credentials and user interaction can exploit this to gain full administrative control, leading to complete compromise of the CMS instance. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Vulnerability AssessmentAI
| Risk Assessment | This vulnerability presents moderate-to-high real-world risk despite a CVSS score of 6.7. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated regular user or editor account gains access through credential compromise or social engineering. The attacker navigates to their author profile edit page and modifies the STATUT field to an administrator value, bypassing validation checks due to improper input handling. … |
| Remediation | Immediately upgrade SPIP to version 4.4.13 or later, which contains the fix for STATUT field validation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Vendor StatusVendor
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | vulnerable | 3.2.11-3+deb11u10 | - |
| bullseye (security) | vulnerable | 3.2.11-3+deb11u7 | - |
| trixie | fixed | 4.4.13+dfsg-0+deb13u1 | - |
| trixie (security) | fixed | 4.4.13+dfsg-0+deb13u1 | - |
| forky, sid | fixed | 4.4.13+dfsg-1 | - |
| (unstable) | fixed | 4.4.13+dfsg-1 | - |
Share
External POC / Exploit Code
Leaving vuln.today