VULNERABILITY INTELLIGENCE

CVE-2025-71242

CVSS score6.5 MEDIUM
EPSS probability0.44%
CISA KEVNot currently listed
Published2026-02-19
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Description

SPIP before 4.3.6, 4.2.17, and 4.1.20 allows unauthorized content disclosure in the private area. The application does not properly check authorization when displaying content of articles and sections (rubriques) in AJAX-loaded fragments, allowing an authenticated attacker to access restricted content. This vulnerability is not mitigated by the SPIP security screen.

Weakness classification

  • 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-285

Primary references