Skip to main content

Fabrik Extension CVE-2026-76598

| EUVDEUVD-2026-64325 HIGH
Improper Access Control (CWE-284)
2026-08-22 Joomla GHSA-pwgr-x5g4-6q22
Authentication Bypass Fabrik Extension For Joomla
8.7
CVSS 4.0 · Vendor: Joomla
Share

Severity by source

Vendor (Joomla) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Arbitrary directory listing confers high confidentiality impact only; no integrity or availability impact described; endpoint is unauthenticated and network-accessible with no complexity barrier.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 22, 2026 - 15:09 vuln.today
CVE Published
Aug 22, 2026 - 14:20 cve.org
HIGH 8.7

DescriptionCVE.org

Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik < 4.7.2 - The onAjax_getFolders method of the elements model allows arbitrary directory listings.

AnalysisAI

Unauthenticated remote attackers can invoke the onAjax_getFolders AJAX method in the Fabrik Extension for Joomla to enumerate arbitrary server-side directories, exposing file system structure without credentials or user interaction. All versions from 1.0.0 through 4.7.1 are affected across the extension's full release history; version 4.7.2 was released to remediate the flaw. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Send unauthenticated AJAX request to onAjax_getFolders
Delivery
Supply attacker-controlled directory path as parameter
Exploit
Receive unrestricted server-side directory listing
Execution
Enumerate file system for sensitive paths and assets
Impact
Use discovered paths to stage follow-on attack
Sign in to reveal

Vulnerability AssessmentAI

Exploitation No special conditions are required beyond the presence of the Fabrik Extension for Joomla in versions 1.0.0 through 4.7.1 and network reachability of the Joomla AJAX endpoint - the onAjax_getFolders method is part of the extension's standard AJAX functionality and requires no non-default configuration or unusual deployment mode. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base score of 8.7 reflects an unauthenticated, network-reachable endpoint requiring no complexity or interaction (AV:N/AC:L/AT:N/PR:N/UI:N), which accurately captures the low barrier to exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An unauthenticated attacker sends a crafted HTTP request to the Joomla site's AJAX handler targeting the Fabrik component's onAjax_getFolders method with an attacker-controlled directory path as the parameter. The server returns a listing of the specified directory, enabling the attacker to map the server's file system, locate configuration files, backup archives, or credential stores for use in follow-on attacks. …
Remediation The primary fix is upgrading the Fabrik Extension for Joomla to version 4.7.2 or later, which removes unauthenticated access to the onAjax_getFolders endpoint; administrators should update via the Joomla Extension Manager and confirm the installed version reflects 4.7.2. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all Joomla instances deploying the Fabrik Extension and determine current versions. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Fabrik Extension For Joomla

View all
CVE-2026-67282 CRITICAL
10.0 Aug 12

Remote code execution in the Fabrik application-builder extension for Joomla (all versions before 4.6.8) lets an unauthe
CVE-2026-66915 CRITICAL
10.0 Aug 10

Remote code execution in the Fabrik application-builder extension for Joomla (versions before 4.6.7) allows unauthentica
CVE-2026-76605 CRITICAL
10.0 Aug 22

Remote code execution in the Fabrik application-builder extension for Joomla (versions 1.0.0 through 4.7.2) lets remote

CVE-2026-76604 CRITICAL
10.0 Aug 22

Remote code execution in the Fabrik extension for Joomla (all versions 1.0.0 through 4.7.2) allows unauthenticated attac
CVE-2026-76606 CRITICAL
10.0 Aug 22

Path traversal in the Fabrik application-builder extension for Joomla (all versions from 1.0.0 through 4.7.2, fixed in 4
CVE-2026-76607 CRITICAL
10.0 Aug 22

Broken access control in the Fabrik application-builder extension for Joomla (all versions from 1.0.0 through releases p
CVE-2026-77992 CRITICAL
9.5 Aug 22

Remote code execution in the Fabrik extension for Joomla (versions 1.0.0 through 4.7.1) allows attackers to break out of
CVE-2026-76571 CRITICAL
9.3 Aug 22

Unauthenticated SQL injection in the Fabrik application-builder extension for Joomla (versions 1.0.0 through 4.7.3, fixe
CVE-2026-76602 CRITICAL
9.3 Aug 22

Unauthenticated SQL injection in the Fabrik extension for Joomla (all versions 1.0.0 through 4.7.2, fixed in 4.7.3) lets
CVE-2026-76597 HIGH
8.7 Aug 22

Unauthenticated arbitrary file upload to the web root is possible in Fabrik (a Joomla extension by fabrikar.com) version
CVE-2026-76596 HIGH
8.7 Aug 22

Unauthenticated table truncation in the Fabrik Extension for Joomla (versions 1.0.0 through 4.7.1) allows any remote att
CVE-2026-76599 HIGH
8.7 Aug 22

Unauthenticated database schema disclosure in Fabrik for Joomla (versions 1.0.0-4.7.1) exposes arbitrary table names, co

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-76598 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy