Atlas-Livre Improper Access Control Vulnerability Under Investigation
Atlas-Livre is under investigation for an improper access control vulnerability that appears to allow unauthenticated attackers to bypass session-based authentication guards and invoke destructive admin actions.
What happened
Atlas-Livre is reportedly affected by a critical improper access control vulnerability (CVE-2026-69703) in the admin controllers under Espace_admin/controleur/. This vulnerability allows unauthenticated attackers to bypass session-based authentication guards by sending raw HTTP requests that ignore redirects. Attackers can potentially invoke destructive admin actions such as record deletion by requesting controller endpoints with GET parameters like supp, because the PHP header() redirect is never followed by an exit or die call, allowing all subsequent code including database operations to execute regardless of session state.
The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8. It is imperative for users of Atlas-Livre to monitor for patches and update to a secure version as soon as it is available. For more detailed information, primary sources should be consulted.
How 0Day mitigates this
atlas-livre is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.