spip is vulnerable to information disclosure. The vulnerability exists due to a lack of validation of access allowing an attacker to access information about editorial objects.
blog.spip.net/Mise-a-jour-critique-de-securite-sorties-de-SPIP-4-0-5-et-SPIP-3-2-14.html
git.spip.net/spip/medias/commit/3014b845da2dd8ad15ff04b50fd9dbba388a9ca2
lists.debian.org/debian-lts-announce/2022/03/msg00020.html
lists.debian.org/debian-security-announce/2022/msg00060.html
security-tracker.debian.org/tracker/CVE-2022-26847