Fabrik Extension CVE-2026-76596

No special conditions are required beyond the target Joomla installation having the Fabrik Extension (versions 1.0.0-4.7.1) installed and the Joomla front-end being publicly accessible over the network. The CVSS 4.0 vector explicitly confirms no privileges (PR:N), no user interaction (UI:N), and no attack requirements (AT:N). Exploitation is limited by: (1) whether Fabrik is installed on the target Joomla site; (2) whether the Joomla front-end is network-reachable; and (3) whether Joomla's global configuration has been set to require login for all front-end access - a non-default setting that would block unauthenticated task dispatch. Default Joomla installations with Fabrik do not enforce front-end authentication, so default configurations of affected versions are exploitable.

The CVSS 4.0 score of 8.7 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N accurately reflects the real-world severity: network-reachable, no privileges, no complexity, no user interaction, and high integrity impact. No EPSS score or CISA KEV status is present in the provided data, so quantified exploitation probability cannot be derived from those signals. However, the triviality of the attack - a single unauthenticated GET request with no specialized knowledge required - means the practical exploitation barrier is lower than EPSS or KEV absence might suggest; the vulnerability is self-weaponizing by description. No confidentiality or availability impact is reflected in the CVSS vector, and this is consistent with the description: data is destroyed rather than exfiltrated, and the Joomla application itself continues running. The primary business risk is irreversible data loss, which is severe for any site using Fabrik as a data store. No conflicting signals are present in the available data; the main gap is the absence of EPSS and KEV data, leaving active exploitation status unconfirmed.

An unauthenticated attacker discovers a Joomla site running Fabrik by identifying the com_fabrik component in page source or HTTP responses. The attacker issues a single HTTP GET request to a URL such as /index.php?option=com_fabrik&task=list.doempty&listid=1, instantly truncating the target database table with no authentication, tokens, or special conditions required. No public exploit code has been identified at time of analysis, but the attack requires no tooling beyond a standard HTTP client.