{"vulnerability": "CVE-2026-104070", "sightings": [{"uuid": "1b8f0b15-73bf-4eb1-96dc-8ccfc8888996", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-104070", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mx7zkxvkqq2l", "content": "\ud83d\udea8 CVE-2026-104070 \u2014 CVSS 9.3 CRITICAL\n\nThe Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthe...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-104070\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-06T18:08:15.304968Z"}, {"uuid": "25b999bf-17bf-40b8-86b7-61fe18f4fa9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-104070", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxa3qr4gzf23", "content": "\ud83d\udd34 CVE-2026-104070 - Critical (9.8)\n\nThe Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allo...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-104070/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-06T18:47:17.395340Z"}, {"uuid": "ec4424ed-e77f-4535-b3c0-4f8528e9e01a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-104070", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/117395650314099839", "content": "Someone needs to check on the USMC.\nhttps://nvd.nist.gov/vuln/detail/cve-2026-104070\n\nThe Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu_ anti-forgery parameter in crayons_store.php, causing the authorization dispatcher to resolve an unconditionally-true handler instead of the proper modification check. Attackers can chain this flaw to write a malicious .html skeleton file, disclose sensitive configuration files containing the site secret, and forge a signed ajax context to execute the uploaded skeleton, achieving arbitrary PHP code execution as the web-server user.", "creation_timestamp": "2026-10-06T19:37:47.210927Z"}, {"uuid": "2c48b16b-376c-4635-b418-1a1e9b9286a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-104070", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxboqzzos72z", "content": "CVE-2026-104070 - spip crayons plugin\nThe Crayons add\u2011on for the SPIP content system (versions before 3.5.0) lets anyone on the internet change content fields without logging in. By skipping a security check, an\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#spip #CVE #infosec", "creation_timestamp": "2026-10-07T10:00:08.642879Z"}]}