Which versions of Joomla Cms are affected by CVE-2026-35223?

Joomla CMS versions 4.0.0-5.4.5 and 6.0.0-6.1.0 contain a flaw allowing privileged administrators to exceed their intended access scope and view sensitive configuration data; no public exploit…

How to fix or mitigate CVE-2026-35223?

Within 24 hours: Inventory all Joomla installations and identify which are running versions 4.0.0-5.4.5 or 6.0.0-6.1.0. Within 7 days: Restrict webservice API access through Web Application Firewall rules or network controls to block the vulnerable com_config endpoint; audit and minimize accounts with high privilege levels; implement detailed logging for configuration data access and changes. Within 30 days: Monitor Joomla security advisories for patch availability; develop an upgrade plan to patched versions once released; evaluate whether disabling the com_config webservice is operationally feasible.

Joomla Cms CVE-2026-35223

Q: What is the CVSS score of CVE-2026-35223?

CVE-2026-35223 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31877 HIGH

Improper Access Control (CWE-284)

2026-05-26 Joomla

GHSA-jvvp-39jc-x988

Authentication Bypass Joomla Cms Joomla Project

8.6

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (Joomla) · only source for this CVE.

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 10:18 vuln.today

CVSS changed

May 26, 2026 - 17:22 NVD

8.6 (HIGH)

CVE Published

May 26, 2026 - 16:43 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

An improper access check allows unauthorized access to com_config webservice endpoints.

AnalysisAI

Authorization bypass in Joomla CMS com_config webservice endpoints allows authenticated attackers with high privileges to access configuration data they should not be permitted to reach, impacting confidentiality, integrity, and availability of the affected site. The flaw spans Joomla 4.0.0-5.4.5 and 6.0.0-6.1.0 and was disclosed by the Joomla! Project itself with a CVSS 4.0 base of 8.6. No public exploit identified at time of analysis and EPSS is very low at 0.04%.