Fabrik CVE-2026-76571

Exploitation requires that the target Joomla site has the Fabrik extension installed at a version at or below 4.7.3 and exposes a Fabrik list whose filter functionality is reachable by the attacker; the specific trigger is supplying a crafted value in the list filter's 'condition' parameter, which reaches getFilterQuery() and is concatenated into the WHERE clause. No authentication, no privileges, and no user interaction are needed (PR:N/UI:N), and it works over the network against a normally deployed list view. The main limiting factor is deployment-specific: a site with no publicly accessible Fabrik list, or with the filter/list restricted behind authentication, reduces or removes the exposed surface.

The signals point to a genuinely high-priority, easily exploitable flaw for anyone running Fabrik. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, score 9.3) reflects network reachability, low complexity, and no privileges or interaction, which is consistent with the 'unauthenticated' framing and the description. One discrepancy worth flagging: the input vector rates integrity and availability as high (VI:H/VA:H), yet the description states the impact is 'full read of the database' - a read-only SELECT-clause injection. Unless the injection can be leveraged into stacked writes or DoS, the confidentiality impact is High while integrity/availability impact is likely overstated in the provided vector; my independent assessment lowers I and A accordingly. No EPSS probability and no KEV listing were provided, so real-world exploitation volume is unquantified - but the ease of exploitation and the value of full database read make this a patch-now item regardless.

An unauthenticated attacker browses to a public Joomla page rendering a Fabrik list, then manipulates the list-filter request so the 'condition' parameter carries crafted SQL (e.g., a UNION-based or boolean/time-based payload). Because the value is concatenated straight into the WHERE clause, the attacker extracts arbitrary tables - Joomla user records, session tokens, and configuration secrets. No exploit code is publicly identified at time of analysis, but the low complexity makes weaponization straightforward.