CVE-2026-104070: Missing Authorization in SPIP SPIP Crayons Plugin

The Crayons plugin for SPIP versions prior to 3.5.0 suffers from a missing authorization vulnerability due to the omission of the secu_ anti-forgery parameter in crayons_store.php. This causes the authorization dispatcher to incorrectly resolve to an unconditionally-true handler instead of performing the proper modification check. Attackers can exploit this flaw to modify editable object fields arbitrarily, write malicious .html skeleton files, disclose sensitive configuration files containing the site secret, and forge a signed ajax context. These chained actions enable arbitrary PHP code execution with the privileges of the web-server user.

Successful exploitation allows unauthenticated attackers to execute arbitrary PHP code on the server, potentially leading to full compromise of the affected web application and server. Sensitive configuration files containing site secrets can be disclosed, increasing the risk of further attacks or data leakage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the SPIP Crayons plugin endpoints and monitor for suspicious activity. Avoid using affected versions prior to 3.5.0 in production environments.