CVE-2026-69703

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-69703

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-69703.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-69703

Published

2026-08-04T18:41:26Z

Modified

2026-10-26T02:30:50Z

Severity

9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Atlas-Livre Unauthenticated Access via Admin Controllers Missing Exit

Details

Atlas-Livre contains an improper access control vulnerability in the admin controllers under Espace_admin/controleur/ that allows unauthenticated attackers to bypass session-based authentication guards by sending raw HTTP requests that ignore redirects. Attackers can invoke destructive admin actions such as record deletion by requesting controller endpoints with GET parameters like supp, because the PHP header() redirect is never followed by an exit or die call, allowing all subsequent code including database operations to execute regardless of session state.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-306"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69703.json"
}

References

Affected packages

Git / github.com/maximeamini/atals-livre

Affected ranges

Type

GIT

Repo

https://github.com/maximeamini/atals-livre

Events

Introduced

Last Affected

de0893f

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "de0893f"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-69703.json"