Fabrik for Joomla CVE-2026-76599

No special conditions are required beyond the Fabrik extension being installed and active on a Joomla site. The CVSS 4.0 vector PR:N/UI:N/AC:L/AT:N confirms unauthenticated, zero-interaction exploitation against default configurations of any Joomla installation running Fabrik 1.0.0-4.7.1. No specific Fabrik feature or non-default setting needs to be enabled - the ajax_tables endpoint is part of the core elements model and is accessible whenever the extension is active. Exploitation is limited to sites that have the Fabrik extension installed and enabled; Joomla sites without Fabrik, or sites already running Fabrik 4.7.2+, are not affected. Network-level restrictions (e.g., WAF rules, IP allowlisting on admin paths) that block unauthenticated AJAX calls would mitigate this.

The CVSS 4.0 score of 8.7 with AV:N/AC:L/AT:N/PR:N/UI:N/VC:H accurately reflects the ease of exploitation: no authentication, no special conditions, accessible over the network. The confidentiality impact is high because database schema metadata - table names, column names, and the Joomla table prefix - provides meaningful reconnaissance that lowers the barrier for follow-on attacks such as targeted SQL injection. No EPSS score was provided in the input data, and this CVE does not appear in CISA KEV, indicating no confirmed active exploitation campaign at time of analysis. No public proof-of-concept code has been identified. Despite the lack of active exploitation signals, the low attack complexity and zero authentication requirement mean opportunistic scanning is plausible once the endpoint location becomes widely known. The risk is primarily reconnaissance-oriented: the vulnerability alone does not allow data modification or denial of service, but it meaningfully enables chained attacks on Joomla sites running affected Fabrik versions.

An unauthenticated attacker sends a crafted HTTP GET or POST request to the Fabrik ajax_tables AJAX endpoint on any publicly accessible Joomla site running Fabrik 1.0.0-4.7.1. The server responds with a structured list of all database table names and their columns, along with the Joomla table prefix. The attacker uses this schema map to identify high-value tables (e.g., user credentials, session tokens) and constructs targeted SQL injection payloads referencing exact table and column names, significantly increasing the precision and success probability of follow-on attacks. No public proof-of-concept has been confirmed, but the endpoint behavior is described in sufficient detail that exploitation requires only basic HTTP tooling.