---
id: CVE-2026-69703
title: >-
  Atlas-Livre contains an improper access control vulnerability in the admin
  controllers under Espace_admin/controleur/ that allows unauthenticated
  attackers to bypass session-based authentication guards by sending raw HTTP
  requests that i…
summary: >-
  Atlas-Livre contains an improper access control vulnerability in the admin
  controllers under Espace_admin/controleur/ that allows unauthenticated
  attackers to bypass session-based authentication guards by sending raw HTTP
  requests that i…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-306
vendor: maximeAmini
product: Atals-Livre
affected:
  - Atals-Livre <= de0893f
published: '2026-08-04'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:43:32.537'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-69703'
references:
  - url: 'https://gist.github.com/arjunjaincs/8cd878b6628d587a1139febd40de9ac6'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/maximeAmini/Atals-Livre'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/atlas-livre-unauthenticated-access-via-admin-controllers-missing-exit
    label: disclosure@vulncheck.com
  - url: 'https://gist.github.com/arjunjaincs/8cd878b6628d587a1139febd40de9ac6'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00826
epssPercentile: 0.55558
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-08-04T19:30:38.910579Z'
ingestedAt: '2026-09-24T15:45:56.717Z'
---

## Overview

Atlas-Livre contains an improper access control vulnerability in the admin controllers under Espace_admin/controleur/ that allows unauthenticated attackers to bypass session-based authentication guards by sending raw HTTP requests that ignore redirects. Attackers can invoke destructive admin actions such as record deletion by requesting controller endpoints with GET parameters like supp, because the PHP header() redirect is never followed by an exit or die call, allowing all subsequent code including database operations to execute regardless of session state.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.