Joomla! CMS CVE-2026-73371

Exploitation requires an active, authenticated session in the Joomla administrator backend - corresponding to CVSS PR:H (high privileges). The attacker must have at minimum a Joomla user account with backend login permission assigned to a group that includes access to the content manager batch actions. The specific limiting factor is that the bypass only affects the copy action of batch operations; other ACL-controlled operations (edit, trash, move) are presumably protected by correct checks. Exploitation is further limited to content items on the same Joomla installation and does not cross site or database boundaries. The vulnerability does not affect front-end (public-facing) Joomla functionality - backend access is mandatory. Non-default deployments that disable all batch actions or use strict group isolation for editorial roles are not exposed.

The CVSS 4.0 base score of 5.1 reflects moderate severity, and the vector metrics align with a realistic threat model: AV:N (network-reachable via standard HTTP), AC:L (no special conditions), but critically PR:H (high privileges required), which substantially constrains the attack surface. The VC:L and all other impact metrics at N indicate limited blast radius - an attacker gains read-level access to content they should not be able to copy, but cannot achieve code execution, authentication bypass at the platform level, or availability disruption. No EPSS data was provided for this CVE. There is no KEV listing and no public POC, so exploitation probability is assessed as low. The 'Authentication Bypass' tag in the source intelligence is somewhat misleading: this is a privilege escalation within an authenticated session, not a bypass of the Joomla login mechanism itself. Real-world priority is low-to-medium for organizations with strict content segmentation (e.g., multi-tenant Joomla installations or sites using granular ACL policies for editorial workflows); minimal concern for single-author or fully open-access deployments.

An authenticated Joomla backend user - such as an author or editor role with access to the content manager but without explicit edit permissions on a restricted article category - sends a crafted POST request to the Joomla administrator batch copy endpoint targeting items outside their authorized scope. The ACL check for the copy action does not verify edit authorization on the source items, so the batch copy succeeds and the restricted content is duplicated into a location the attacker controls or can read. No public POC is available, but the attack requires only standard Joomla admin interface knowledge.