What is the CVSS score of CVE-2026-62414?

CVE-2026-62414 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Page Builder CK are affected by CVE-2026-62414?

Page Builder CK extension for Joomla (versions 1.0.0-3.6.1) contains an access control flaw allowing unauthenticated attackers to view restricted frontend page lists, creating unauthorized disclosure…

How to fix or mitigate CVE-2026-62414?

Within 24 hours, audit all Joomla deployments to identify instances running Page Builder CK extension versions 1.0.0-3.6.1. Within 7 days, disable the extension in production and implement compensating controls including Web Application Firewall rules to restrict access to the vulnerable endpoints, IP-based access restrictions on Joomla administrative functions, and enhanced access logging. Within 30 days, establish a monitoring process for vendor security advisories, evaluate replacement page builder extensions, and develop a timeline for migration if no patch is released within 60 days.

Page Builder CK CVE-2026-62414

EUVD-2026-46086 CRITICAL

Improper Access Control (CWE-284)

2026-07-20 security@joomla.org

GHSA-4jc6-j4qv-pxq3

Authentication Bypass

9.1

CVSS 3.1 · Vendor: joomla

Severity by source

Vendor (joomla) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.5 HIGH

Network-reachable list view with no auth (AV:N/AC:L/PR:N/UI:N); an access-control bypass on read-oriented views yields confidentiality exposure (C:H) but no supported integrity or availability impact (I:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (joomla).

CVSS VectorVendor: joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 21:35 vuln.today

CVSS changed

Jul 22, 2026 - 20:22 NVD

9.1 (CRITICAL)

CVE Published

Jul 20, 2026 - 19:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 20, 2026 - 19:17 cve.org

CRITICAL 9.1

DescriptionCVE.org

The Joomla extension Page Builder CK does not properly apply access control to frontend page list views.

AnalysisAI

Improper access control in the Page Builder CK extension for Joomla (versions 1.0.0 through 3.6.1) allows remote unauthenticated attackers to enumerate and view frontend page list views that should be restricted, effectively bypassing intended authentication on that view. The CVSS 9.1 rating reflects high confidentiality and integrity exposure over the network with no privileges or user interaction, though CISA's SSVC assessment rates the technical impact as only 'partial' and no public exploit has been identified. EPSS is very low (0.13%, 3rd percentile), indicating no observed exploitation activity to date.

Technical ContextAI

Page Builder CK is a drag-and-drop content/page building extension for the Joomla CMS, developed by Joomlack (joomlack.fr). The root cause is classified as CWE-284 (Improper Access Control): the extension fails to enforce authorization checks when rendering frontend 'page list' views, so access-control decisions that should gate who can see the list of pages are not applied consistently. Tagged as an Authentication Bypass, the flaw lets requests reach a view component without passing through the expected permission/ACL enforcement layer of Joomla, exposing page listings (and potentially unpublished or access-restricted page metadata) to users who should not see them.

RemediationAI

No vendor-released patch version was identified in the available data; the affected range ends at 3.6.1, so administrators should upgrade Page Builder CK to the first release published after 3.6.1 once confirmed on the vendor site (https://www.joomlack.fr/) and monitor the Joomla vulnerable extensions list (reported via security@joomla.org). As a compensating control until a fixed version is verified, restrict or disable frontend menu items that expose Page Builder CK page list views, or place the affected frontend endpoints behind authentication/an access level that requires login (Joomla ACL 'Registered' or higher), accepting that this removes anonymous access to legitimately public pages built with the extension. Web-application-firewall rules blocking direct requests to the vulnerable list-view component task/URL are a further stopgap, with the trade-off of potential false positives against legitimate page rendering.