Joomla! CMS CVE-2026-73336

Exploitation requires an authenticated session with high-privilege Joomla! CMS access - specifically a Super User or Administrator role - as confirmed by PR:H in the CVSS 4.0 vector. The precise triggering condition is the ability to create or edit content that Joomla! serializes into schema.org markup output (e.g., article fields, organization metadata, custom fields mapped to structured-data properties); without the ability to write to these inputs, the vulnerability cannot be exercised. Sites that have disabled schema.org structured-data output entirely, or that restrict administrator account creation to a small and trusted group, face a substantially reduced exposure. Limiting factors include the high privilege barrier (PR:H), which categorically excludes unauthenticated remote exploitation, and the absence of any server-side impact (VA:N, SC:N, SI:N, SA:N per CVSS 4.0), confining harm to client-side script execution in victim browsers.

The CVSS 4.0 base score of 5.1 with PR:H accurately characterizes a constrained attack surface: only accounts holding high-level CMS privileges can inject the payload, which sharply limits the realistic attacker pool to insiders, compromised administrator accounts, or adversaries who have already obtained privileged credentials through a prior step. No public exploit code has been identified and the vulnerability does not appear in CISA KEV, leaving exploitation probability low at time of analysis; EPSS data was not supplied in the source intelligence. The downstream blast radius is further bounded by the CVSS 4.0 subsequent-system metrics (SC:N/SI:N/SA:N), confirming no server-side integrity or availability compromise - harm is confined to client-side script execution against users who load affected pages. In practical terms, even a mid-sized municipal IT team in gdynia running Joomla! for public-facing portals would be exposed only if an existing privileged account were malicious or compromised, making this a meaningful but non-urgent priority absent specific insider threat indicators. The risk profile most closely resembles a privilege-escalation amplifier rather than a standalone remote attack vector.

A malicious or compromised Joomla! administrator injects a crafted JavaScript payload into a content field rendered as schema.org structured-data output - such as an article description, organization name, or custom metadata field. When site visitors or authenticated staff subsequently load pages containing the tainted markup, the unsanitized script executes in their browsers, enabling session cookie theft or forced redirection to attacker-controlled infrastructure. No public proof-of-concept has been identified at time of analysis, but the attack is mechanically straightforward for any actor already in possession of the required high-privilege credentials.