EUVD-2026-52866
GHSA-vcrm-cmp2-rj83
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated remote GET reaches admin functions with no user interaction (AV:N/AC:L/PR:N/UI:N); full read/modify/delete of admin data yields C:H/I:H/A:H, scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Atlas-Livre contains an improper access control vulnerability in the admin controllers under Espace_admin/controleur/ that allows unauthenticated attackers to bypass session-based authentication guards by sending raw HTTP requests that ignore redirects. Attackers can invoke destructive admin actions such as record deletion by requesting controller endpoints with GET parameters like supp, because the PHP header() redirect is never followed by an exit or die call, allowing all subsequent code including database operations to execute regardless of session state.
Articles & Coverage 1
AnalysisAI
Authentication bypass in Atlas-Livre, a PHP guestbook/livre d'or web application by maximeAmini, lets unauthenticated remote attackers reach admin-only controller endpoints under Espace_admin/controleur/ and trigger destructive actions such as record deletion. The flaw stems from PHP redirect guards that call header() without a following exit/die, so protected code keeps executing regardless of session state. No public exploit is confirmed via KEV, though a referenced GitHub gist may contain proof-of-concept material; there is no active-exploitation listing at time of analysis.
Technical ContextAI
The application is written in PHP and follows a controller pattern, with administrative logic in files under Espace_admin/controleur/. Access control relies on a session check that, when the user is unauthenticated, issues a redirect via PHP's header('Location: ...'). Because header() only queues an HTTP response header and does not halt script execution, the absence of a subsequent exit or die means every statement below the guard - including database mutation queries - still runs. This is a textbook instance of CWE-306 (Missing Authentication for Critical Function): the critical function is reachable because the guard is advisory rather than enforcing. Any HTTP client that simply ignores the 302 redirect (curl without -L, a raw socket request, or a script) receives and triggers the full server-side effect. The affected package is identified by CPE cpe:2.3:a:maximeamini:atals-livre (note the vendor's own 'Atals-Livre' spelling), with all versions in scope.
RemediationAI
No vendor-released patch or fixed version has been identified at time of analysis, so remediation currently depends on code-level fixes and access restrictions. The root cause is that every session-check redirect uses header('Location: ...') without halting execution; the primary fix is to add an explicit exit; (or die;) immediately after each such header() call in the admin controllers under Espace_admin/controleur/, ensuring no downstream database code runs for unauthenticated requests - ideally centralizing the auth guard into a single include invoked before any controller logic. As a compensating control until code is fixed, restrict network access to the Espace_admin/ path at the web server or reverse proxy layer (for example, an Nginx/Apache deny rule or HTTP Basic auth on the admin directory), accepting that legitimate admins must connect from an allowed source or supply the extra credential. Blocking or IP-allowlisting the admin endpoints avoids exposing destructive parameters such as supp to the internet; the trade-off is added operational friction for administrators and no protection against an attacker already inside the trusted network segment. Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/atlas-livre-unauthenticated-access-via-admin-controllers-missing-exit) and the upstream repository (https://github.com/maximeAmini/Atals-Livre) for updates.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today