Joomla Cms CVE-2026-21629

Q: What is the CVSS score of CVE-2026-21629?

CVE-2026-21629 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17853 MEDIUM

Improper Access Control (CWE-284)

2026-04-01 Joomla

Authentication Bypass Joomla Cms

6.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Apr 01, 2026 - 10:00 euvd

EUVD-2026-17853

Analysis Generated

Apr 01, 2026 - 10:00 vuln.today

CVE Published

Apr 01, 2026 - 09:03 nvd

MEDIUM 6.3

DescriptionCVE.org

The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers.

AnalysisAI

Joomla CMS fails to enforce authenticated user checks on the AJAX component in the administrative area, allowing potential authentication bypass and unauthorized access to sensitive functionality. Third-party developers expecting default access controls may expose administrative features to unauthenticated or unauthorized users. No CVSS score or public exploit code has been identified, but the vulnerability affects all Joomla CMS versions and requires immediate review of custom AJAX implementations that rely on implicit authentication enforcement.

Technical ContextAI

The vulnerability stems from improper access control enforcement (CWE-284: Improper Access Control) in Joomla's AJAX component architecture. The AJAX endpoint in the administrative area was excluded from Joomla's default logged-in-user authentication check, which represents a deviation from the expected security model. Third-party component developers who integrate with this AJAX component may have implemented custom handlers assuming the parent framework enforces authentication, when in fact the component explicitly bypasses such checks. This creates a gap between documented security assumptions and actual runtime behavior, potentially exposing administrative functionality to unauthorized access.

RemediationAI

Joomla recommends hardening of ACL (Access Control List) enforcement in the com_ajax component per the official security advisory at https://developer.joomla.org/security-centre/1027-20260301-core-acl-hardening-in-com-ajax.html. Administrators should review and update to the patched version specified in the Joomla security notice. Third-party component developers must audit custom AJAX handlers to ensure they explicitly enforce authentication and authorization checks rather than relying on implicit framework-level enforcement. Any AJAX endpoints in administrative components should include explicit user authentication verification before processing requests.