CVE-2025-71242

EUVD-2025-207683
SPIP before 4.3.6, 4.2.17, and 4.1.20 allows unauthorized content disclosure in the private area. The application does not properly check authorization when displaying content of articles and sections (rubriques) in AJAX-loaded fragments, allowing an authenticated attacker to access restricted content. This vulnerability is not mitigated by the SPIP security screen.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 16.09%
Affected Products (NVD)
VendorProductVersion
spipspip
4.1.0 ≤
𝑥
< 4.1.20
spipspip
4.2.0 ≤
𝑥
< 4.2.17
spipspip
4.3.0 ≤
𝑥
< 4.3.6
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
spip
bullseye
vulnerable
bullseye (security)
vulnerable
forky
4.4.19+dfsg-1
fixed
sid
4.4.20+dfsg-1
fixed
trixie
4.4.15+dfsg-0+deb13u1
fixed
trixie (security)
4.4.20+dfsg-0+deb13u1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
spip
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
questing
not-affected
resolute
not-affected
xenial
ignored
Common Weakness Enumeration
References
https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-3-6.html
https://git.spip.net/spip/spip
https://www.vulncheck.com/advisories/spip-authorization-bypass-leading-to-content-disclosure