Joomla CMS CVE-2026-90907

The profile.save controller is reachable and does not validate the requester's login state, so account creation succeeds even on sites where public user registration is disabled - that registration-disabled bypass is the core condition and the reason it matters. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, user interaction, or special configuration is required; exploitation works against default configurations of Joomla core in the affected version ranges. The principal LIMITING factor is impact scope: only guest-level (lowest-privilege) accounts can be created, not administrative or full user accounts.

The vendor (Joomla) CVSS 4.0 vector rates this 6.9 with AV:N/AC:L/AT:N/PR:N/UI:N and confidentiality-only impact (VC:L), meaning a remote, unauthenticated attacker can trigger it against default configurations with no user interaction. That low-complexity, no-privilege network profile is the aggravating factor; the mitigating factor is the impact ceiling - the flaw only creates guest-level (lowest-privilege) accounts. The vendor's choice of VC:L (confidentiality) is questionable: unauthorized account creation is fundamentally an integrity/authorization impact (CWE-639), so an assessed vector using VI:L/I:L is more faithful, though the numeric score lands similarly (~5.3 in CVSS 3.1). There is no EPSS score, no CISA KEV listing, and no public exploit code identified in the provided data, so this is not confirmed as actively exploited. No SSVC decision data was supplied. Net: a genuine unauthenticated authorization-bypass in an extremely widely deployed CMS, but the low real-world impact (guest accounts only) keeps it a moderate rather than urgent priority. No signals conflict, but note the CVSS impact-dimension labeling (confidentiality vs integrity) disagrees with the described effect.

An unauthenticated attacker sends a crafted POST request to the profile.save controller on a Joomla site - even one that has public user registration disabled - and the controller, failing to verify login state, creates a new guest-level account. This lets attackers seed accounts on sites that intended to block self-registration, useful for spam, reconnaissance of authenticated surfaces, or as a foothold for chaining. No public exploit code is identified at time of analysis.