EUVD-2026-89076
GHSA-4xw6-jw26-gp2r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAccess public Joomla tag/tagged-item output
-
ExploitRequest items filtered by tag
-
ExecutionACL check omitted on tagged output
-
ImpactView content from inaccessible categories
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the Joomla site to expose tagged-item output (tag views, tag-based listings or the tagged-items module) where tagged content spans categories with differing access levels - the bug is that the ACL/category access check is not applied to these tagged outputs. Exploitation needs NO authentication and NO user interaction (PR:N/UI:N), so any anonymous visitor can trigger it against a default install running an affected version (4.0.0-5.4.8 or 6.0.0-6.1.3). The limiting factor is impact scope: only content items that have been tagged and placed in access-restricted categories are exposed, and only their content is disclosed (confidentiality-only, no modification or DoS). |
| Impact | This is a genuine but low-to-moderate priority issue. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) scoring 6.9 signals a remotely reachable, unauthenticated, low-complexity flaw - but crucially the impact is confidentiality-only and rated LOW, with no integrity or availability effect and no scope change. So despite the 'medium' numeric score, this is an information-disclosure ACL bypass, not a system compromise. No EPSS score, no CISA KEV listing, and no public POC were provided, meaning there is no evidence of exploitation activity - status is 'no public exploit identified at time of analysis.' The most notable signal is PR:N: unlike its self-reported sibling Joomla ACL advisories from the same September 2026 batch (CVE-2026-92223/92225/92232/92222, all PR:H authenticated), this flaw requires NO authentication, which meaningfully broadens who can exploit it. The CWE-284 (improper access control) classification is consistent with the description; note the 'Authentication Bypass' tag is loose - this is authorization bypass / info disclosure, not credential/authentication bypass. Net: a real, broadly-deployed-product issue worth patching, but the low confidentiality-only impact keeps it below the memory-corruption/RCE tier. |
| Exploit ScenarioDerived | An unauthenticated visitor to a Joomla site browses tagged-item listings (e.g. a tag view or tagged-content module) and receives content items that belong to categories their access level should hide, such as registered-only or restricted articles. Because no login is required and complexity is low, this can be probed directly against default configurations. No public exploit code is available at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Improper access-control checks in Joomla's tagged-item output let unauthenticated visitors read content items that belong to access-restricted categories, exposing only article content (confidentiality-only) with no modification or denial-of-service impact. Affected releases are Joomla! CMS 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3; exploitation requires no authentication and no user interaction (PR:N/UI:N in both the supplied CVSS 4.0 vector and our assessed CVSS 3.1 vector), so any anonymous visitor can trigger it on a default site that renders tagged items where tags span categories with differing view levels. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited; the practical risk is bounded because disclosure is limited to tagged items in restricted categories, which is why our independent assessment treats this as a genuine but low-to-moderate priority issue.
RemediationAI
Patch status must be taken from the vendor advisory: the supplied data does not state an exact fixed version, so consult the Joomla Security Centre advisory 20260907 (https://developer.joomla.org/security-centre/1087-20260907-core-improper-acl-checks-in-outputs-for-tagged-items.html) and apply the corrected Joomla! CMS release it identifies for the 4.x/5.x and 6.x branches, then re-check that the installed version has moved past the affected windows (4.0.0-5.4.8 and 6.0.0-6.1.3). If immediate patching is not possible, the most effective compensating control is to stop exposing tag-based output: unpublish or disable the "tagged items" module and any menu item or template override that renders com_tags list/layout output, accepting the trade-off that tag navigation, tag clouds, and tag-based SEO landing pages will disappear or 404. Alternatively, audit which categories use restricted Access Levels and remove tags from the articles inside them, or set those tags to unpublished, with the trade-off that editors lose tagging metadata for that content and tag associations must be restored after patching. Once tagged output is re-enabled or the site is patched, review web logs for requests to com_tags/tag view endpoints carrying unusual tag IDs as a retroactive indicator of content enumeration; note that no authentication is required, so IP-based blocking, rate limiting, or WAF rules are only weak friction rather than a real fix and cannot distinguish legitimate tag browsing from enumeration.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is rooted in CWE-284 (Improper Access Control) and sits in Joomla's tagging subsystem, i.e. the com_tags component and the "tagged items" module/layouts that aggregate articles by their assigned tags. Joomla enforces content visibility through Access Levels (viewing access levels applied to categories and articles), and core components are expected to re-apply that category-level ACL check whenever they render items pulled out of context. In the vulnerable versions the tagged-item output paths resolve and render articles without re-checking the access level of the category each article belongs to, so content that would be hidden on a normal category or article view is exposed through the tag-based listing. The supplied CPE cpe:2.3:a:joomla!_project:joomla!_cms:*:*:*:*:*:*:*:* is version-agnostic, so it identifies the Joomla! CMS product family rather than a precise build; the authoritative affected windows come from the advisory text (4.0.0-5.4.8 and 6.0.0-6.1.3). The CVSS 4.0 vector supplied by the vendor (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) describes a network-reachable, unauthenticated, no-interaction bug with low confidentiality impact and no subsequent-system impact; our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) agrees on the attack prerequisites and on impact being confined to information disclosure.
Know when Joomla Cms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Unauthenticated network access with no interaction (PR:N/UI:N) but only low-severity read exposure of restricted tagged content, so C:L and I/A:N.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
DescriptionCVE.org
Joomla! Core - [20260907] - Core - Improper ACL checks in outputs for tagged items in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to view content items from inaccessible categories.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Joomla Cms
View allImproper access control in Joomla! CMS webservice endpoints allows unauthorized attackers to bypass authentication and a
Transport encryption downgrade in Joomla! CMS password and username reset workflows causes reset links to be generated w
Unrestricted SHTML file upload in Joomla! CMS affects all versions from 1.0.0 through 5.4.7 and 6.0.0 through 6.1.2, imp
Server-side request forgery (SSRF) in Joomla CMS versions 4.0.0-5.4.8 and 6.0.0-6.1.3 allows an authenticated, high-priv
Path traversal (Zip Slip) in Joomla 6.1.1's com_joomlaupdate component enables persistent remote code execution when a S
Arbitrary file deletion in Joomla! CMS com_joomlaupdate component via the autoupdate server mechanism allows remote atta
Authorization bypass in Joomla CMS com_config webservice endpoints allows authenticated attackers with high privileges t
Inconsistent access control enforcement in Joomla! CMS REST API webservice endpoints allows authenticated users with ins
MFA bypass in Joomla! CMS 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3 allows an attacker who can drive the login flow to
Multi-factor authentication bypass in Joomla! CMS versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2 allows remote att
Authentication bypass in Joomla! CMS 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to circumvent multi-factor auth
Two-factor authentication bypass in Joomla! CMS versions 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to circumve
Exploit-DB