EUVD-2026-49791
GHSA-fc63-j395-8683
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description explicitly states 'read/write user account access', confirming both confidentiality and integrity impacts beyond the original vector.
Primary rating from Vendor (joomla).
CVSS VectorVendor: joomla
Lifecycle Timeline
3DescriptionCVE.org
Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle < 3.1.1 - The default configuration of the extension allowed read access and password reset of CMS accounts.
AnalysisAI
Joomdle component for Joomla versions below 3.1.1 ships with an insecure default configuration that allows unauthenticated remote attackers to read CMS user account details and perform password resets, effectively enabling account takeover. The flaw is confirmed by the Joomla security team and tracked in ENISA EUVD, though no indicators of active exploitation are present at this time.
Technical ContextAI
The Joomdle extension bridges the Joomla CMS with Moodle learning management systems. The vulnerability arises from a CWE-200 (Exposure of Sensitive Information) issue in the default configuration of affected versions. This configuration inadvertently exposes user data and password reset functionality without requiring authentication, exposing sensitive account information directly to remote requests. The affected CPE pattern covers Joomdle component versions 0.7.0 through 3.0.1.
RemediationAI
Upgrade to Joomdle version 3.1.1 or later where the default configuration has been hardened. The primary vendor advisory is available at https://www.joomdle.com/. As a temporary workaround, review and lock down the extension’s configuration settings to restrict unauthenticated access to user data endpoints, though the exact parameter changes are not detailed in public advisories; upgrading is the only confirmed fix.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today