EUVD-2026-42064
GHSA-wrj5-rcww-hh9r
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible API; PR:L rather than PR:H because the bypass description implies authentication is present but authorization boundaries are improperly enforced; scope change reflects high downstream impact on privacy data systems.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
Lifecycle Timeline
1DescriptionCVE.org
An improper access check allows unauthorized users to access com_privacy datasets.
AnalysisAI
Improper access control in Joomla! CMS exposes com_privacy component webservice endpoints to users lacking the required authorization, allowing unauthorized reads of GDPR/privacy datasets. The flaw is classified as CWE-284 and impacts downstream systems at high severity per the vendor-supplied CVSS 4.0 vector, despite requiring high privileges on the vulnerable system itself - a tension that suggests role-boundary bypass rather than fully unauthenticated access. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Technical ContextAI
Joomla! CMS includes a com_privacy component that manages GDPR and privacy-request workflows, exposing REST-based webservice endpoints for data access. The vulnerability (CWE-284: Improper Access Control) indicates that the authorization check governing access to com_privacy datasets is either absent or incorrectly implemented, allowing a request to succeed for a user whose role should prohibit it. The affected product is identified via CPE cpe:2.3:a:joomla!_project:joomla!_cms:*:*:*:*:*:*:*:*, with the wildcard indicating the full version range is potentially in scope. The advisory URL path ('core-incorrect-access-control-in-com-privacy-webservice-endpoints') confirms the attack surface is the CMS REST API layer, not the administrative UI. The CVSS 4.0 subsequent-system metrics (SC:H/SI:H/SA:H) indicate that the privacy data accessed through this endpoint has high-impact downstream implications - likely because com_privacy stores sensitive personal data subject to regulatory handling.
RemediationAI
Consult the Joomla! Security Centre advisory at https://developer.joomla.org/security-centre/1065-20260711-core-incorrect-access-control-in-com-privacy-webservice-endpoints.html for the patched release version and upgrade instructions; no specific fixed version number was provided in the available intelligence data, so the advisory is the authoritative source. If immediate patching is not feasible, disable Joomla! REST API access for the com_privacy component at the web server level (e.g., block the relevant API route in nginx or Apache config), noting that this will interrupt any integrations relying on programmatic privacy-request management. As an additional compensating control, restrict webservice endpoint access to known trusted IP ranges to reduce exposure to external actors, accepting the trade-off that internal threats are not mitigated. Organizations subject to GDPR or equivalent data protection regulation should treat this as a compliance incident and assess whether unauthorized access has already occurred.
More in Joomla Cms
View allTransport encryption downgrade in Joomla! CMS password and username reset workflows causes reset links to be generated w
Unrestricted SHTML file upload in Joomla! CMS affects all versions from 1.0.0 through 5.4.7 and 6.0.0 through 6.1.2, imp
Path traversal (Zip Slip) in Joomla 6.1.1's com_joomlaupdate component enables persistent remote code execution when a S
Arbitrary file deletion in Joomla! CMS com_joomlaupdate component via the autoupdate server mechanism allows remote atta
Authorization bypass in Joomla CMS com_config webservice endpoints allows authenticated attackers with high privileges t
Improper access control in Joomla! CMS webservice endpoints allows unauthorized attackers to bypass authentication and a
Inconsistent access control enforcement in Joomla! CMS REST API webservice endpoints allows authenticated users with ins
Multi-factor authentication bypass in Joomla! CMS versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2 allows remote att
Authentication bypass in Joomla! CMS 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to circumvent multi-factor auth
Two-factor authentication bypass in Joomla! CMS versions 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to circumve
Privilege escalation in Joomla! CMS versions 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0 allows remote attackers to abus
Privilege escalation in Joomla! CMS versions 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to abuse the com_users
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today