Joomla! CMS CVE-2026-35220

The victim must be an authenticated Joomla! CMS administrator (PR:H confirmed by CVSS vector) with an active backend session at the time of attack. The attacker must induce the administrator to actively interact with a malicious page or link (UI:A) - passive drive-by delivery is insufficient. The vulnerable endpoint is the admin-facing user activation endpoint within the com_users component, meaning the Joomla backend must be accessible from the network path the attacker can influence. Exploitation is limited by: the requirement for high-privilege victim authentication; the need for active user interaction rather than passive loading; and the low integrity-only impact scope confined to the vulnerable system (SC:N rules out lateral scope impact). Default Joomla installations include com_users, so no non-default configuration is required for the endpoint to exist, but an administrator must be logged in concurrently with the attacker's delivery attempt.

Multiple signals converge on a low-to-medium real-world risk profile. The CVSS 4.0 base score of 4.6 reflects the constrained impact: VI:L (low integrity impact on the vulnerable component only), with no confidentiality or availability impact (VC:N/VA:N/SC:N/SI:N). PR:H and UI:A are significant limiters - successful exploitation requires the attacker to socially engineer a currently authenticated Joomla administrator into clicking a malicious link or visiting a crafted page, ruling out automated mass exploitation. SSVC confirms 'Automatable: no,' reinforcing this. EPSS at 0.02% (5th percentile) indicates very low observed exploitation activity relative to the broader CVE population. No KEV listing and no public POC further support deprioritization for most organizations. This is a legitimate vulnerability warranting patching but not emergency response; it is unlikely to be weaponized at scale given the required preconditions. The primary risk is in environments with high-value Joomla admin accounts targeted via spear-phishing or malicious advertising.

An attacker identifies a target organization running Joomla! CMS 6.0.x or 6.1.x and crafts a malicious web page containing a hidden form that silently submits a POST request to the target site's admin user activation endpoint upon page load. The attacker sends a phishing email to a known Joomla administrator; when the admin opens the link while their backend session is active, the browser automatically submits the forged request with the admin's valid session cookies, activating an otherwise-pending or suspended user account without the admin's knowledge. No public POC is known at time of analysis, but this attack class requires only basic web knowledge to construct.