CVE-2026-69703 Details

A vulnerability in Atlas-Livre's admin controllers allows unauthenticated attackers to bypass session-based authentication. This is achieved by sending raw HTTP requests that ignore redirects, exploiting the fact that the PHP header() function used for redirection does not terminate script execution. As a result, attackers can access controller endpoints with GET parameters, such as 'supp', to invoke destructive actions like deleting records. This vulnerability arises because the authentication check fails to properly validate session states before executing critical database operations.

To address this vulnerability, add an 'exit' or 'die' call after the header() redirect in all affected controller files. Additionally, implement proper authentication checks to ensure that only authorized users can access critical admin functions.