EUVD-2026-14268
GHSA-x592-5gwh-wjg9
Severity by source
AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L
Lifecycle Timeline
4DescriptionCVE.org
SPIP 4.4.10 through 4.4.12 before 4.4.13 allows unintended privilege assignment (of administrator privileges) during the editing of an author data structure because of STATUT mishandling.
AnalysisAI
SPIP versions 4.4.10 through 4.4.12 contain a privilege escalation vulnerability that allows authenticated users with limited permissions to assign administrator privileges to themselves or other accounts through improper handling of the STATUT field during author data structure editing. An attacker with login credentials and user interaction can exploit this to gain full administrative control, leading to complete compromise of the CMS instance. The vulnerability was patched in version 4.4.13.
Technical ContextAI
SPIP is a PHP-based content management system (identified via CPE cpe:2.3:a:spip:spip) that manages user roles and permissions through a STATUT (status) field within author data structures. The vulnerability stems from CWE-688 (Incorrect Asynchronous Event Handling, though in this context reflects improper input validation and authorization logic), where the STATUT parameter is not properly validated or sanitized during the author editing workflow. This allows an authenticated user to directly manipulate their privilege level without proper authorization checks, bypassing the intended role-based access control mechanism.
RemediationAI
Immediately upgrade SPIP to version 4.4.13 or later, which contains the fix for STATUT field validation. See the vendor security advisory at https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-13.html for detailed upgrade instructions. If immediate patching is not feasible, restrict administrative access permissions to trusted user accounts only, audit existing author accounts for unauthorized privilege levels, and monitor author editing logs for suspicious STATUT modifications. Additionally, implement a Web Application Firewall (WAF) rule to detect and block attempts to manipulate the STATUT field with administrator values if you are unable to patch immediately.
The Security Screen (_core_/securite/ecran_securite.php) before 1.1.8 for SPIP, as used in SPIP 3.0.x before 3.0.12, all
Cross-site scripting (XSS) vulnerability in valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to inject
Directory traversal vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to en
The SPIP template composer/compiler in SPIP 3.1.2 and earlier allows remote authenticated users to execute arbitrary PHP
SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. Rated critical severity (CVSS 9.8), th
SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. R
SPIP 3.0.x before 3.0.9, 2.1.x before 2.1.22, and 2.0.x before 2.0.23 allows remote attackers to gain privileges and "ta
SPIP v4.1.5 and earlier was discovered to contain a SQL injection vulnerability via the _oups parameter. Rated critical
Cross-site request forgery (CSRF) vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote a
RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via the _oups parameter. Ra
Spip Web Framework v3.1.13 and below was discovered to contain multiple SQL injection vulnerabilities at /ecrire via the
A PHP injection vulnerability in Spip before v3.2.8 allows attackers to execute arbitrary PHP code via the _oups paramet
Same technique Information Disclosure
View allVendor StatusVendor
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | vulnerable | 3.2.11-3+deb11u10 | - |
| bullseye (security) | vulnerable | 3.2.11-3+deb11u7 | - |
| trixie | fixed | 4.4.13+dfsg-0+deb13u1 | - |
| trixie (security) | fixed | 4.4.13+dfsg-0+deb13u1 | - |
| forky, sid | fixed | 4.4.13+dfsg-1 | - |
| (unstable) | fixed | 4.4.13+dfsg-1 | - |
Share
External POC / Exploit Code
Leaving vuln.today