CVE-2026-69703
CriticalCVSS 9.8Summary
Atlas-Livre contains an improper access control vulnerability in the admin controllers that allows unauthenticated attackers to bypass session-based authentication guards by sending raw HTTP requests that ignore redirects. Attackers can invoke destructive admin actions such as record deletion without authentication.
Risk Assessment
The risk includes unauthorized access to administrative functions, potentially leading to data loss and system integrity compromise.
Recommendation
It is recommended to immediately update Atlas-Livre to a patched version and add proper access controls and exit/die calls after redirects.
Original NVD description (English source)
Atlas-Livre contains an improper access control vulnerability in the admin controllers under Espace_admin/controleur/ that allows unauthenticated attackers to bypass session-based authentication guards by sending raw HTTP requests that ignore redirects. Attackers can invoke destructive admin actions such as record deletion by requesting controller endpoints with GET parameters like supp, because the PHP header() redirect is never followed by an exit or die call, allowing all subsequent code including database operations to execute regardless of session state.