Fabrik CVE-2026-76602

The target must expose a Fabrik list view (list model) that is reachable by the attacker and that accepts the 'order' sort parameter - this is the default behavior of Fabrik lists, so no unusual configuration is required. Per the CVSS vector (PR:N/UI:N/AT:N), no authentication and no user interaction are needed, meaning any anonymous request to a public Fabrik list is sufficient; the practical limiting factor is whether the Fabrik list is publicly accessible versus gated behind Joomla ACLs or a login. Exploitation also depends on the site running an affected version (1.0.0 through 4.7.2). Because the description scopes this to read SQLi vectors, the achievable outcome is primarily data disclosure rather than data modification.

The signals are strong on exposure but nuanced on impact. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a trivially reachable, unauthenticated, network-facing attack surface with low complexity, which fully justifies treating exposure as urgent for any internet-facing Fabrik deployment. However, the vendor-scored VI:H/VA:H (integrity and availability high) conflicts with the description, which explicitly limits this to 'read SQLi vectors' - ORDER BY injection generally yields confidentiality impact (data exfiltration) but not straightforward write/modification or destruction unless stacked queries are supported, so the real integrity/availability impact is likely lower than the 9.3 base score implies; verify with the vendor before assuming full write capability. There is no EPSS score, no KEV listing, and no known POC in the provided data, so exploitation is currently theoretical though technically easy. Given the low barrier, operators should not wait for a POC to appear before patching.

An unauthenticated attacker browses to a public Fabrik list page, then submits a crafted 'order' parameter containing a SQL subquery or boolean/time-based payload instead of a valid sort column. The application concatenates it into the ORDER BY clause and executes it, letting the attacker iteratively extract Joomla user records, session data, or other database contents. No known POC is published, but the low complexity and lack of authentication make exploitation straightforward for a skilled attacker.