CVE-2026-69703

Atlas-Livre contains an improper access control vulnerability in the admin controllers under Espace_admin/controleur/ that allows unauthenticated attackers to bypass session-based authentication guards by sending raw HTTP requests that ignore redirects. Attackers can invoke destructive admin actions such as record deletion by requesting controller endpoints with GET parameters like supp, because the PHP header() redirect is never followed by an exit or die call, allowing all subsequent code including database operations to execute regardless of session state.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://gist.github.com/arjunjaincs/8cd878b6628d587a1139febd40de9ac6
https://github.com/maximeAmini/Atals-Livre
https://www.vulncheck.com/advisories/atlas-livre-unauthenticated-access-via-admin-controllers-missing-exit
https://gist.github.com/arjunjaincs/8cd878b6628d587a1139febd40de9ac6

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Atlas-Livre contiene una vulnerabilidad de control de acceso inadecuado en los controladores de administración bajo Espace_admin/controleur/ que permite a atacantes no autenticados eludir las protecciones de autenticación basadas en sesión enviando solicitudes HTTP sin procesar que ignoran las redirecciones. Los atacantes pueden invocar acciones administrativas destructivas, como la eliminación de registros, solicitando puntos finales del controlador con parámetros GET como supp, porque la redirección PHP header() nunca es seguida por una llamada a exit o die, permitiendo que todo el código subsiguiente, incluidas las operaciones de base de datos, se ejecute independientemente del estado de la sesión.

Information

Published : 2026-08-04 19:16

Updated : 2026-10-24 16:10

NVD link : CVE-2026-69703

Mitre link : CVE-2026-69703

CVE.ORG link : CVE-2026-69703

JSON object : View

Products Affected

No product.

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2026-69703", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-69703", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-04T19:30:38.910579Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "maximeAmini", "product": "Atals-Livre", "versions": [{"status": "affected", "version": "0", "versionType": "git", "lessThanOrEqual": "de0893f"}], "defaultStatus": "affected"}]}], "published": "2026-08-04T19:16:54.130", "references": [{"url": "https://gist.github.com/arjunjaincs/8cd878b6628d587a1139febd40de9ac6", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/maximeAmini/Atals-Livre", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/atlas-livre-unauthenticated-access-via-admin-controllers-missing-exit", "source": "disclosure@vulncheck.com"}, {"url": "https://gist.github.com/arjunjaincs/8cd878b6628d587a1139febd40de9ac6", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "Atlas-Livre contains an improper access control vulnerability in the admin controllers under Espace_admin/controleur/ that allows unauthenticated attackers to bypass session-based authentication guards by sending raw HTTP requests that ignore redirects. Attackers can invoke destructive admin actions such as record deletion by requesting controller endpoints with GET parameters like supp, because the PHP header() redirect is never followed by an exit or die call, allowing all subsequent code including database operations to execute regardless of session state."}, {"lang": "es", "value": "Atlas-Livre contiene una vulnerabilidad de control de acceso inadecuado en los controladores de administraci\u00f3n bajo Espace_admin/controleur/ que permite a atacantes no autenticados eludir las protecciones de autenticaci\u00f3n basadas en sesi\u00f3n enviando solicitudes HTTP sin procesar que ignoran las redirecciones. Los atacantes pueden invocar acciones administrativas destructivas, como la eliminaci\u00f3n de registros, solicitando puntos finales del controlador con par\u00e1metros GET como supp, porque la redirecci\u00f3n PHP header() nunca es seguida por una llamada a exit o die, permitiendo que todo el c\u00f3digo subsiguiente, incluidas las operaciones de base de datos, se ejecute independientemente del estado de la sesi\u00f3n."}], "lastModified": "2026-10-24T16:10:00.153", "sourceIdentifier": "disclosure@vulncheck.com"}