Vulnerability · Published Aug 4, 2026 · Assigned by VulnCheck

CVE-2026-69703Atlas-Livre Unauthenticated Access via Admin Controllers Missing Exit

Critical 9.8

In plain English

A critical-severity missing authentication in Atals-Livre from maximeAmini. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.6%top 51.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Atlas-Livre contains an improper access control vulnerability in the admin controllers under Espace_admin/controleur/ that allows unauthenticated attackers to bypass session-based authentication guards by sending raw HTTP requests that ignore redirects. Attackers can invoke destructive admin actions such as record deletion by requesting controller endpoints with GET parameters like supp, because the PHP header() redirect is never followed by an exit or die call, allowing all subsequent code including database operations to execute regardless of session state.

Affected products (as reported)

Vendor	Product	Versions
maximeAmini	Atals-Livre	0 – through de0893f

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Product Repository product
Github Gist technical-description
https://www.vulncheck.com/advisories/atlas-livre-unauthenticated-access-via-admin-controllers-missing-exit third-party-advisory