Cotton Cloud CVE-2026-67284

Q: What is the CVSS score of CVE-2026-67284?

CVE-2026-67284 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 35.0%.

Q: Which versions of Cotton Cloud are affected by CVE-2026-67284?

Improper access control in the Cotton Cloud Joomla extension (versions prior to 2.0.3) enables horizontal privilege escalation across user accounts within a shared Joomla installation.

EUVD-2026-57162 MEDIUM

Improper Access Control (CWE-284)

2026-08-12 security@joomla.org

GHSA-mcj5-vx8j-3qrg

Authentication Bypass

5.3

CVSS 4.0 · Vendor: joomla

Severity by source

Vendor (joomla) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network-reachable via standard HTTP, low complexity, requires authenticated session (PR:L), no user interaction; limited cross-user file read/write with no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (joomla).

CVSS VectorVendor: joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 10:32 vuln.today

DescriptionCVE.org

Joomla Extension - tabaoca.org - Improper ACL implementation allows file operations in Cotton Cloud < 2.0.3 - Authenticated users could perform various file-related operations (read, delete, overwrite, re-assign permissions) on files owned by other users.

AnalysisAI

Improper access control in the Cotton Cloud Joomla extension (versions prior to 2.0.3) enables horizontal privilege escalation across user accounts within a shared Joomla installation. Any authenticated user - regardless of privilege level - can read, delete, overwrite, or reassign permissions on files owned by other users, bypassing the extension's intended ACL enforcement. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity makes exploitation straightforward for any credentialed user.

Technical ContextAI

Cotton Cloud is a file-management Joomla extension developed by tabaoca.org. Joomla extensions implement their own access control logic on top of Joomla's core ACL framework, and this extension (per CWE-284, Improper Access Control) fails to enforce ownership checks before processing file operations - read, delete, overwrite, and permission reassignment - allowing requests from any authenticated session to target files owned by other users. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L) confirms the flaw is network-reachable with low complexity and requires only a standard authenticated session, consistent with a missing server-side ownership validation on file operation endpoints.

RemediationAI

Upgrade Cotton Cloud to version 2.0.3 or later, which introduces corrected ACL enforcement that restricts file operations to the owning user. The vendor advisory is available at https://www.tabaoca.org/. If immediate patching is not possible, site administrators should restrict the Cotton Cloud extension's functionality to a minimal set of trusted users via Joomla's core ACL manager (disabling access for general authenticated users), or temporarily disable the extension entirely until the patch can be applied. Disabling the extension avoids exposure but removes all file-management functionality provided by the extension for all users - assess operational impact before applying this workaround.