Fabrik for Joomla CVE-2026-76608

No special conditions are required - the vulnerable onGetEmail endpoint is accessible to unauthenticated network requesters on any default installation of Fabrik versions 1.0.0-4.7.1 running on a Joomla CMS site. The CVSS 4.0 vector (PR:N, AC:L, AT:N) confirms no authentication, no elevated complexity, and no specific attack requirements. The only limiting factors are: the target must be running an active Joomla instance with the Fabrik extension installed and enabled, and the attacker must know or enumerate valid commenter record IDs to retrieve associated email addresses. There is no required user interaction, no non-default configuration, and no platform restriction.

The CVSS 4.0 score of 6.9 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L warrants scrutiny: the provided vector assigns no confidentiality impact (VC:N) despite the flaw being an email disclosure issue, and credits a low integrity impact (VI:L) which is not clearly supported by the description of read-only data leakage. The more accurate characterization is a low confidentiality impact rather than an integrity impact - this inconsistency should be verified with the vendor or NVD. EPSS data was not included in the provided intelligence, so exploitation probability cannot be quantified probabilistically. No KEV listing and no known POC suppress the urgency signals from those frameworks. However, the zero-barrier entry - unauthenticated, network-accessible, no special tooling required - means the flaw is mechanically trivial to exploit by any party who can send HTTP requests to the target. The meaningful real-world risk vector here is GDPR and equivalent privacy regulation exposure: unintended disclosure of commenter email addresses constitutes a personal data breach under most data protection frameworks, carrying notification obligations and potential fines regardless of CVSS score. Sites collecting commenter data should treat this as a compliance priority even in the absence of active exploitation signals.

An unauthenticated attacker sends crafted HTTP requests to a Joomla site's Fabrik onGetEmail endpoint, iterating over commenter ID values to systematically retrieve associated email addresses. Because no credential or session token is required, this can be scripted in minutes using basic tools such as curl or a simple Python loop. No public proof-of-concept code has been identified at time of analysis, but the simplicity of the missing access check means independent rediscovery requires no specialized knowledge.