Joomla Cms CVE-2026-23899

Attacker requires high-privilege credentials or administrative access to the system. Exploitation targets webservice endpoints with improper access controls (CWE-284). No victim interaction required. Affects default webservice configurations where authorization checks are bypassed.

While CVSS and EPSS scores are not available for this CVE, the vulnerability presents significant real-world risk due to its nature as an authentication bypass. The attack vector is network-based with no authentication required (implicit from the improper access control classification), and the impact is high because unauthorized actors can access administrative webservice endpoints. Joomla! CMS is widely deployed across thousands of websites globally, making this a high-impact vulnerability. The lack of CVSS data should not diminish urgency; unauthenticated access to webservice endpoints in a content management system typically allows data theft, site defacement, privilege escalation, or remote code execution through secondary mechanisms. The affected product (Joomla! CMS) represents a single, monolithic open-source platform where exploitability is straightforward once the access control bypass is understood, suggesting high real-world priority regardless of missing metrics.

An unauthenticated attacker discovers the webservice endpoint vulnerability and crafts HTTP requests to Joomla! webservice APIs that normally require administrative authentication. Due to the improper access control check, the requests are processed without validation, allowing the attacker to retrieve sensitive data (such as user lists, configuration details, or database content) or modify site configuration without logging in. The attacker may then escalate privileges or pivot to remote code execution through a secondary vulnerability or by uploading malicious content via the compromised API.