Skip to main content

Fabrik CVE-2026-76607

| EUVDEUVD-2026-64319 CRITICAL
Improper Access Control (CWE-284)
2026-08-22 Joomla GHSA-9r4g-3fgh-v3g8
Authentication Bypass Fabrik Extension For Joomla
10.0
CVSS 4.0 · Vendor: Joomla
Share

Severity by source

Vendor (Joomla) PRIMARY
10.0 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Unauthenticated network access to an unprotected download element yields file disclosure, so PR:N/AC:L with C:H; no evidence of integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 22, 2026 - 15:13 vuln.today
CVE Published
Aug 22, 2026 - 14:15 cve.org
CRITICAL 10.0

DescriptionCVE.org

Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.3 - ???.

AnalysisAI

Broken access control in the Fabrik application-builder extension for Joomla (all versions from 1.0.0 through releases prior to 4.7.3) exposes the download element without enforcing ACL checks, letting remote attackers retrieve files that should be restricted to privileged users. The flaw is remotely reachable over the network with no authentication or user interaction (CVSS vector PR:N/UI:N) and is tagged as an authentication bypass. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify Joomla site running Fabrik < 4.7.3
Delivery
Locate download element endpoint
Exploit
Request protected file without authorization
Execution
ACL check absent, file returned
Impact
Exfiltrate restricted data
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires that the target Joomla site has the Fabrik extension installed at a version below 4.7.3 AND uses Fabrik's download element to serve files that are meant to be access-restricted. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The input assigns a maximal CVSS 4.0 score of 10.0 (AV:N/AC:L/AT:N/PR:N/UI:N with full High vulnerable- AND subsequent-system impact), which appears inflated for a missing-ACL flaw in a download element: the concrete described behavior is unauthorized file retrieval, which is primarily a confidentiality impact, so the High integrity/availability and subsequent-system (SC/SI/SA:H) metrics are not substantiated by the description - treat the 10.0 as a worst-case reporter rating and verify actual impact with the vendor. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An unauthenticated attacker enumerates a public Joomla site running Fabrik, then requests a download-element URL that serves a file intended only for logged-in or privileged users; because the ACL check is missing, the server returns the protected file. Repeating this against known element/record identifiers lets the attacker harvest restricted documents at scale. …
Remediation Vendor-released patch: 4.7.3 - upgrade the Fabrik extension to 4.7.3 or later on all Joomla installations, as this is the version that introduces the missing ACL enforcement on the download element. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, disable the Fabrik download element in all production environments or implement firewall and WAF rules to block access to Fabrik file download paths if the extension cannot be immediately disabled. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Fabrik Extension For Joomla

View all
CVE-2026-67282 CRITICAL
10.0 Aug 12

Remote code execution in the Fabrik application-builder extension for Joomla (all versions before 4.6.8) lets an unauthe
CVE-2026-66915 CRITICAL
10.0 Aug 10

Remote code execution in the Fabrik application-builder extension for Joomla (versions before 4.6.7) allows unauthentica
CVE-2026-76605 CRITICAL
10.0 Aug 22

Remote code execution in the Fabrik application-builder extension for Joomla (versions 1.0.0 through 4.7.2) lets remote

CVE-2026-76604 CRITICAL
10.0 Aug 22

Remote code execution in the Fabrik extension for Joomla (all versions 1.0.0 through 4.7.2) allows unauthenticated attac
CVE-2026-76606 CRITICAL
10.0 Aug 22

Path traversal in the Fabrik application-builder extension for Joomla (all versions from 1.0.0 through 4.7.2, fixed in 4
CVE-2026-77992 CRITICAL
9.5 Aug 22

Remote code execution in the Fabrik extension for Joomla (versions 1.0.0 through 4.7.1) allows attackers to break out of
CVE-2026-76571 CRITICAL
9.3 Aug 22

Unauthenticated SQL injection in the Fabrik application-builder extension for Joomla (versions 1.0.0 through 4.7.3, fixe
CVE-2026-76602 CRITICAL
9.3 Aug 22

Unauthenticated SQL injection in the Fabrik extension for Joomla (all versions 1.0.0 through 4.7.2, fixed in 4.7.3) lets
CVE-2026-76598 HIGH
8.7 Aug 22

Unauthenticated remote attackers can invoke the onAjax_getFolders AJAX method in the Fabrik Extension for Joomla to enum
CVE-2026-76597 HIGH
8.7 Aug 22

Unauthenticated arbitrary file upload to the web root is possible in Fabrik (a Joomla extension by fabrikar.com) version
CVE-2026-76596 HIGH
8.7 Aug 22

Unauthenticated table truncation in the Fabrik Extension for Joomla (versions 1.0.0 through 4.7.1) allows any remote att
CVE-2026-76599 HIGH
8.7 Aug 22

Unauthenticated database schema disclosure in Fabrik for Joomla (versions 1.0.0-4.7.1) exposes arbitrary table names, co

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-76607 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy