The flaw in Atlas‑Livre’s admin controllers allows an unauthenticated attacker to bypass session‑based authentication checks because the PHP header() redirect is not followed by an exit or die statement. As a result, malicious GET requests such as ?supp=… can invoke destructive logic, deleting database records. The weakness is an improper access control issue classified as CWE‑306.

Atlas‑Livre by maximeAmini is affected. No specific version range is provided, so any release that contains the referenced admin controllers could be vulnerable.

The CVSS base score of 9.3 indicates a critical vulnerability, and the EPSS score is not available. The issue is not listed in CISA KEV. Attackers can exploit it remotely with simple HTTP requests that do not require authentication, so the attack vector is likely a web request to a vulnerable admin endpoint. Because the flaw enables data deletion, the risk for confidentiality and integrity is high.