CVE-2026-69703 describes an improper access control vulnerability in the admin controllers of the Atlas-Livre product by maximeAmini. The flaw exists in the Espace_admin/controleur/ directory, where unauthenticated attackers can bypass session-based authentication guards by sending raw HTTP requests that do not follow the PHP header() redirect. Since the redirect is not terminated with exit or die, subsequent code including destructive database operations (e.g., record deletion via GET parameters like 'supp') executes regardless of authentication state. This allows attackers to perform critical admin actions without valid credentials.

The vulnerability allows unauthenticated attackers to bypass authentication and perform destructive administrative actions such as deleting records. This can lead to data loss and compromise of the integrity of the application’s data. The CVSS 4.0 score of 9.3 reflects a critical severity with network attack vector, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider implementing additional access controls or web application firewall rules to block unauthorized access to admin controller endpoints. Developers should ensure that PHP header() redirects are always followed by exit or die calls to prevent code execution after redirects.