Fabrik for Joomla CVE-2026-76601

No authentication is required - the Fabrik order plugin accepts row reorder requests from any unauthenticated HTTP client (CVSS PR:N, AV:N, AC:L). The sole prerequisite is that the Fabrik extension (versions 1.0.0-4.7.1) is installed and active on a publicly or network-accessible Joomla instance. Exploitation is strictly bounded to integrity: an attacker can reorder records within Fabrik lists but cannot read, exfiltrate, create, or delete data. Joomla sites that do not have Fabrik installed, or that have upgraded to 4.7.2, are not affected. Sites running Fabrik but with the order plugin disabled are also unaffected by this specific issue.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, score 6.9) confirms low-complexity, unauthenticated, network-reachable exploitation with no preconditions - a broad attack surface. However, the impact metrics are constrained to VI:L with no confidentiality or availability consequences, meaning an attacker can reorder records but cannot read, exfiltrate, create, or destroy data. No EPSS score was provided in the input, so exploitation probability cannot be quantified. There is no KEV listing and no known POC, indicating this is not currently under active or widespread exploitation. Real-world risk is context-dependent: sites where Fabrik list ordering drives business logic (display priority, workflow sequencing, ranking) face meaningful operational disruption; sites using ordering purely cosmetically face negligible impact. The unauthenticated, zero-complexity attack path warrants prompt patching despite the limited per-record impact.

An unauthenticated attacker identifies a Joomla site running Fabrik 4.7.1 or earlier and sends a crafted HTTP request to the order plugin endpoint specifying a new row sequence. Because no access check is performed, the server accepts the request and persists the reordered record positions to the database. No public exploit code has been identified at time of analysis, but the attack requires no credentials, no special tooling, and no user interaction, making it trivially reproducible by any attacker aware of the endpoint structure.