CVE-2026-33549: 
NixOS vulnerability analysis and mitigation

CVE-2026-33549 is a privilege escalation vulnerability in SPIP, an open-source web publishing system, caused by improper handling of the STATUT field during the editing of author data structures. It affects SPIP versions 4.4.10 through 4.4.12, and was fixed in version 4.4.13. The vulnerability was first published on March 22, 2026, with a patch released on April 17, 2026. It carries a CVSS v3.1 base score of 8.8 (High) per NVD, reflecting network-based exploitation by low-privileged authenticated users without user interaction (SPIP Blog, EUVD).

The root cause is classified as CWE-688 (Function Call With Incorrect Variable or Reference as Argument), specifically involving mishandling of the STATUT field when an author data structure is edited in SPIP's private interface (prive component). An authenticated low-privileged user can manipulate the author editing form in a way that causes the application to incorrectly assign administrator-level STATUT to their account. The fix is documented in a commit to the spip/prive repository, which corrects the argument passed during status evaluation (SPIP Git Commit, SPIP MR).

Successful exploitation allows a low-privileged authenticated user to escalate their privileges to full administrator level within the SPIP application. This grants the attacker complete control over the CMS, including the ability to modify content, install plugins, access sensitive user data, and potentially achieve server-side code execution through administrator-only features. The impact spans confidentiality, integrity, and availability of the affected SPIP installation (EUVD).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (EUVD). The vulnerability requires a low-privileged authenticated account, which limits the attack surface compared to unauthenticated vulnerabilities. The EPSS score is approximately 0.037%, indicating a low current probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available via Nessus (IDs 303300, 303302) and Qualys (ID 6274952) (Tenable).

1. Obtain a low-privileged account: Register or obtain credentials for a standard author-level account on a SPIP instance running versions 4.4.10 through 4.4.12.
2. Access the author editing interface: Log in to the SPIP private interface (/ecrire/) and navigate to the author profile editing page.
3. Manipulate the STATUT field: Craft or intercept the HTTP request submitted when saving author data, modifying the STATUT parameter to a value corresponding to administrator privileges (e.g., 0minirezo).
4. Submit the manipulated request: Send the crafted request to the SPIP backend; due to the STATUT mishandling bug, the application incorrectly processes the value and assigns administrator privileges to the account.
5. Verify privilege escalation: Log out and back in, then confirm that the account now has administrator-level access within the SPIP administration panel (SPIP Git Commit, SPIP MR).

• Logs: SPIP application logs showing an author account's STATUT field changing to 0minirezo (administrator) without a corresponding administrative action by a legitimate admin; repeated POST requests to the author editing endpoint (/ecrire/?exec=auteur) from non-admin accounts.
• Application State: Unexpected accounts appearing in the SPIP administrator list; author accounts with recently elevated privileges that do not correspond to legitimate admin grants.
• Network: Unusual or repeated POST requests to /ecrire/?exec=auteur or similar SPIP private interface endpoints from the same authenticated session, particularly with modified form fields.

The primary remediation is to upgrade SPIP to version 4.4.13 or later, which contains the fix for the STATUT mishandling issue (SPIP Blog). As an interim measure, administrators should restrict the number of users with author editing privileges and audit existing accounts for unexpected privilege escalation. Monitoring authentication and activity logs for suspicious privilege changes is also recommended until patching is completed.

The vulnerability received coverage from security aggregators and national CERTs, including INCIBE-CERT (Spain) and Linux security advisories noting a Debian DSA update for SPIP (INCIBE, Linux Security). A brief technical write-up was published by Infinit Security shortly after disclosure (Infinit Security). No significant social media controversy or major vendor statements beyond the official SPIP security blog post have been observed.