CVE-2026-22205
SPIP < 4.4.10 Authentication Bypass via PHP Type Juggling
CVE-2026-22205 is a high vulnerability (CVSS 8.7) in Spip, published February 26, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.54%, the 45th percentile. Fixed in spip 4.4.11+dfsg-0+deb13u1.
SPIP versions prior to 4.4.10 contain an authentication bypass vulnerability caused by PHP type juggling that allows unauthenticated attackers to access protected information. Attackers can exploit loose type comparisons in authentication logic to bypass login verification and retrieve sensitive internal data.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
SPIP < 4.4.10 Authentication Bypass via PHP Type Juggling
SPIP versions prior to 4.4.10 contain an authentication bypass vulnerability caused by PHP type juggling that allows unauthenticated attackers to access protected information. Attackers can exploit loose type comparisons in authentication logic to bypass login verification and retrieve sensitive internal data.
- Record
CVE-2026-22205- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-288
- Updated
- 2026-11-02
EUVDEUVD-2026-8883
SPIP versions prior to 4.4.10 contain an authentication bypass vulnerability caused by PHP type juggling that allows unauthenticated attackers to access protected information. Attackers can exploit loose type comparisons in authentication logic to bypass login verification and retrieve sensitive internal data.
- Record
EUVD-2026-8883- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-gxmj-pr3w-6wmh
SPIP versions prior to 4.4.10 contain an authentication bypass vulnerability caused by PHP type...
SPIP versions prior to 4.4.10 contain an authentication bypass vulnerability caused by PHP type juggling that allows unauthenticated attackers to access protected information. Attackers can exploit loose type comparisons in authentication logic to bypass login verification and retrieve sensitive internal data.
- Record
GHSA-gxmj-pr3w-6wmh- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-288
- Updated
- 2026-11-02
NVD
SPIP versions prior to 4.4.10 contain an authentication bypass vulnerability caused by PHP type juggling that allows unauthenticated attackers to access protected information. Attackers can exploit loose type comparisons in authentication logic to bypass login verification and retrieve sensitive internal data.
- Record
CVE-2026-22205- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-288
- Updated
- 2026-11-02
OSV
SPIP < 4.4.10 Authentication Bypass via PHP Type Juggling
SPIP versions prior to 4.4.10 contain an authentication bypass vulnerability caused by PHP type juggling that allows unauthenticated attackers to access protected information. Attackers can exploit loose type comparisons in authentication logic to bypass login verification and retrieve sensitive internal data.
- Record
CVE-2026-22205- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-288
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-22205
SPIP versions prior to 4.4.10 contain an authentication bypass vulnerability caused by PHP type juggling that allows unauthenticated attackers to access protected information. Attackers can exploit loose type comparisons in authentication logic to bypass login verification and retrieve sensitive internal data.
- Record
DEBIAN-CVE-2026-22205- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-22205
SPIP versions prior to 4.4.10 contain an authentication bypass vulnerability caused by PHP type juggling that allows unauthenticated attackers to access protected information. Attackers can exploit loose type comparisons in authentication logic to bypass login verification and retrieve sensitive internal data.
- Record
UBUNTU-CVE-2026-22205- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
spipDebian:13 |
before 4.4.11+dfsg-0+deb13u1, plus listed versions 4.4.10+dfsg-14.4.3+dfsg-14.4.3+dfsg-1+deb13u14.4.4+dfsg-14.4.5+dfsg-1 Show 4 moreShow less4.4.6+dfsg-14.4.7+dfsg-14.4.8+dfsg-14.4.9+dfsg-1 |
4.4.11+dfsg-0+deb13u1 |
spipDebian:14 |
before 4.4.10+dfsg-1, plus listed versions 4.4.3+dfsg-14.4.4+dfsg-14.4.5+dfsg-14.4.6+dfsg-14.4.7+dfsg-14.4.8+dfsg-14.4.9+dfsg-1 |
4.4.10+dfsg-1 |
spipUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 3.0.20-13.0.21-13.0.21-1ubuntu13.0.21-1ubuntu1+esm1 |
None known |
spipUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 3.1.4-33.1.4-4~deb9u3build0.18.04.13.1.4-4~deb9u5build0.18.04.13.1.4-4~deb9u5ubuntu0.1~esm2 |
None known |
spipUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 3.2.4-13.2.5-13.2.7-13.2.7-1ubuntu0.13.2.7-1ubuntu0.1+esm2 |
None known |
spipUbuntu:22.04:LTS |
All versions, plus listed versions 3.2.11-33.2.12-14.0.2-14.0.4-1 |
None known |
spipUbuntu:24.04:LTS |
All versions, plus listed versions 4.1.11+dfsg-14.1.12+dfsg-14.1.13+dfsg-14.1.15+dfsg-14.2.9+dfsg-2 |
None known |
spipUbuntu:25.10 |
All versions, plus listed versions 4.3.8+dfsg-14.4.3+dfsg-1 |
None known |
spipUbuntu:26.10 |
All versions, plus listed versions 4.4.9+dfsg-14.4.15+dfsg-14.4.16+dfsg-14.4.19+dfsg-14.4.20+dfsg-14.4.21+dfsg-1 |
None known |
spipUbuntu:26.04:LTS |
All versions, plus listed versions 4.4.3+dfsg-14.4.6+dfsg-14.4.7+dfsg-14.4.8+dfsg-14.4.9+dfsg-1 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, NVD, OSV |
References
blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-10.html
git.spip.net/spip/spip
vulncheck.com/advisories/spip-sql-injection-rce-via-union-php-tags
nvd.nist.gov/vuln/detail/CVE-2026-22205
github.com/advisories/GHSA-gxmj-pr3w-6wmh
security-tracker.debian.org/tracker/CVE-2026-22205
ubuntu.com/security/CVE-2026-22205
cve.org/CVERecord?id=CVE-2026-22205