Fabrik for Joomla CVE-2026-76603

The Fabrik extension for Joomla (any version 1.0.0-4.7.2) must be installed and enabled on the target Joomla site. The form.inlineedit controller endpoint must be publicly reachable - i.e., the Joomla front-end is internet-accessible and not restricted by IP allowlist or authentication wall. No authenticated session, no special role, and no non-default Fabrik configuration is required; the omission of access checks is unconditional in the affected versions. Exploitation is limited to read-only row disclosure (no write/delete capability implied) and to data stored within Fabrik-managed tables. Sites that front Joomla behind authenticated reverse proxies or that have disabled Fabrik's front-end component access via Joomla's global configuration are not exploitable.

The CVSS 4.0 base score of 6.9 reflects a fully network-accessible, zero-interaction, unauthenticated attack path (AV:N/AC:L/AT:N/PR:N/UI:N) with low confidentiality impact to the vulnerable system (VC:L) and no integrity or availability impact. The low-confidentiality rating is appropriate because disclosure is limited to individual form rows rather than bulk database dumps, though repeated requests could enumerate significant data sets. No EPSS score was provided in the source data; given the absence of KEV listing and known POC code, opportunistic mass exploitation appears unlikely at present, but the zero-barrier exploitation conditions (no account, no special network position) mean any motivated actor can attempt it trivially. Defenders on sites using Fabrik for sensitive intake forms (contact data, registrations, surveys) should treat this as a medium-high priority patch despite the moderate CVSS score. No conflicting signals between CVSS vector and the description were identified.

An unauthenticated attacker who knows (or discovers via fingerprinting) that a Joomla site runs Fabrik sends a crafted HTTP GET or POST request targeting index.php?option=com_fabrik&task=form.inlineedit with a target row identifier; the controller returns the requested row's field values without any session or permission check. Repeated iteration over row IDs would enumerate form submission data. No public exploit code has been identified at time of analysis, but the attack requires only standard HTTP tooling.