EUVD-2026-42060
GHSA-7vw9-q236-92vj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:H reflects required high-privilege injection; S:C because XSS executes in victim's browser context; C:L/I:L for session theft and page manipulation; no availability impact.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
Lifecycle Timeline
1DescriptionCVE.org
Lack of validation leads to an XSS vulnerability in the MFA management views.
AnalysisAI
Cross-site scripting in Joomla! CMS multi-factor authentication management views allows a high-privileged attacker to inject persistent malicious scripts that execute in the browser of any administrator who subsequently views the MFA management interface. Affected versions span two major release lines: 4.2.0-5.4.6 and 6.0.0-6.1.1, representing a broad surface across both legacy and current deployments. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, successful exploitation yields high confidentiality and integrity impact against the victim administrator's browser session.
Technical ContextAI
The affected product is Joomla! CMS (CPE: cpe:2.3:a:joomla!_project:joomla!_cms), a widely-deployed PHP-based open-source content management system. The vulnerable component is the MFA (multi-factor authentication) method management interface in the Joomla! administrator back-end, introduced with Joomla! 4.2.0. CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting) identifies the root cause: user-supplied input submitted through MFA management views is insufficiently validated and/or not properly output-encoded before being rendered into HTML, allowing injected script content to be stored and later executed in other users' browser sessions. Because the MFA subsystem handles sensitive configuration data (second-factor method settings, labels, parameters), attacker-controlled values in this surface can persist and execute in privileged administrative contexts.
RemediationAI
Upgrade Joomla! CMS to the patched release identified in the vendor security advisory at https://developer.joomla.org/security-centre/1057-20260703-core-xss-in-mfa-method-management.html - the exact fixed version number is not specified in the available intelligence and must be confirmed directly from that advisory before deploying. As an interim compensating control, restrict back-end access to the MFA method management interface to only the minimum set of trusted Super User accounts using Joomla!'s Access Control List (ACL); note that ACL misconfiguration carries a risk of locking out legitimate administrators, so changes should be tested in a non-production environment first. Additionally, enforcing multi-factor authentication on all Joomla! administrator accounts reduces the risk that a stolen session token from this XSS can be reused without a second factor.
More in Joomla Cms
View allTransport encryption downgrade in Joomla! CMS password and username reset workflows causes reset links to be generated w
Unrestricted SHTML file upload in Joomla! CMS affects all versions from 1.0.0 through 5.4.7 and 6.0.0 through 6.1.2, imp
Path traversal (Zip Slip) in Joomla 6.1.1's com_joomlaupdate component enables persistent remote code execution when a S
Arbitrary file deletion in Joomla! CMS com_joomlaupdate component via the autoupdate server mechanism allows remote atta
Authorization bypass in Joomla CMS com_config webservice endpoints allows authenticated attackers with high privileges t
Improper access control in Joomla! CMS webservice endpoints allows unauthorized attackers to bypass authentication and a
Inconsistent access control enforcement in Joomla! CMS REST API webservice endpoints allows authenticated users with ins
Multi-factor authentication bypass in Joomla! CMS versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2 allows remote att
Authentication bypass in Joomla! CMS 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to circumvent multi-factor auth
Two-factor authentication bypass in Joomla! CMS versions 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to circumve
Privilege escalation in Joomla! CMS versions 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0 allows remote attackers to abus
Privilege escalation in Joomla! CMS versions 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to abuse the com_users
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today