Joomla! CMS CVE-2026-35220

Q: What is the CVSS score of CVE-2026-35220?

CVE-2026-35220 has a CVSS 4.0 base score of 4.6 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31889 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-26 Joomla

GHSA-h52w-g3vr-5c63

CSRF Joomla Cms

4.6

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

4.6 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 11:08 vuln.today

CVSS changed

May 26, 2026 - 17:22 NVD

4.6 (MEDIUM)

CVE Published

May 26, 2026 - 16:45 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Lack of CSRF token validation lead to a CSRF attack vector in the admin activation endpoint of com_users.

AnalysisAI

CSRF token validation is absent on the admin user activation endpoint (com_users component) in Joomla! CMS 6.0.0 through 6.1.0, allowing a remote attacker to trigger unauthorized user activation actions by luring an authenticated administrator into visiting a crafted page. The CVSS 4.0 vector (PR:H/UI:A) confirms exploitation requires an active, logged-in administrator and deliberate user interaction, constraining real-world risk despite the network-accessible attack vector. No public exploit code exists and CISA has not added this to KEV; EPSS places exploitation probability at 0.02% (5th percentile), consistent with SSVC's 'none' exploitation status.

Technical ContextAI

The vulnerability resides in the com_users component of Joomla! CMS - the core user management subsystem responsible for registration, authentication, and account activation workflows. CWE-352 (Cross-Site Request Forgery) indicates the affected activation endpoint processes state-changing HTTP requests without verifying that the request originates from a legitimate, same-origin session (i.e., no CSRF token is checked). Affected product confirmed via CPE cpe:2.3:a:joomla!_project:joomla!_cms:*:*:*:*:*:*:*:* and EUVD version range 6.0.0-6.1.0. Because the activation endpoint is admin-facing, the attack surface is confined to the Joomla backend administrative panel rather than the public front-end, which limits exposure to environments where administrators are active and their sessions can be targeted.

RemediationAI

Apply the Joomla! security patch as detailed in the official Joomla Security Centre advisory at https://developer.joomla.org/security-centre/1037-20260505-core-csrf-in-user-activation-endpoint. The advisory was published 2026-05-05; organizations running Joomla! CMS 6.0.0-6.1.0 should upgrade to the first release that addresses this CVE per Joomla's release notes - the exact patched version is not independently confirmed in the provided data and should be verified against the vendor advisory. As a compensating control pending patching, restrict backend administrative access to trusted IP ranges via server-level rules (e.g., nginx/Apache allow/deny directives or WAF IP allowlisting) to reduce the likelihood of an attacker being able to deliver the CSRF payload to an active admin session; note this does not eliminate the vulnerability but significantly narrows the attack surface. Additionally, ensure administrator sessions have short inactivity timeouts to limit the window during which a CSRF attack can succeed.