EUVD-2026-17853Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers.
AnalysisAI
Joomla CMS fails to enforce authenticated user checks on the AJAX component in the administrative area, allowing potential authentication bypass and unauthorized access to sensitive functionality. Third-party developers expecting default access controls may expose administrative features to unauthenticated or unauthorized users. No CVSS score or public exploit code has been identified, but the vulnerability affects all Joomla CMS versions and requires immediate review of custom AJAX implementations that rely on implicit authentication enforcement.
Technical ContextAI
The vulnerability stems from improper access control enforcement (CWE-284: Improper Access Control) in Joomla's AJAX component architecture. The AJAX endpoint in the administrative area was excluded from Joomla's default logged-in-user authentication check, which represents a deviation from the expected security model. Third-party component developers who integrate with this AJAX component may have implemented custom handlers assuming the parent framework enforces authentication, when in fact the component explicitly bypasses such checks. This creates a gap between documented security assumptions and actual runtime behavior, potentially exposing administrative functionality to unauthorized access.
RemediationAI
Joomla recommends hardening of ACL (Access Control List) enforcement in the com_ajax component per the official security advisory at https://developer.joomla.org/security-centre/1027-20260301-core-acl-hardening-in-com-ajax.html. Administrators should review and update to the patched version specified in the Joomla security notice. Third-party component developers must audit custom AJAX handlers to ensure they explicitly enforce authentication and authorization checks rather than relying on implicit framework-level enforcement. Any AJAX endpoints in administrative components should include explicit user authentication verification before processing requests.
More in Joomla Cms
View allTransport encryption downgrade in Joomla! CMS password and username reset workflows causes reset links to be generated w
Unrestricted SHTML file upload in Joomla! CMS affects all versions from 1.0.0 through 5.4.7 and 6.0.0 through 6.1.2, imp
Path traversal (Zip Slip) in Joomla 6.1.1's com_joomlaupdate component enables persistent remote code execution when a S
Arbitrary file deletion in Joomla! CMS com_joomlaupdate component via the autoupdate server mechanism allows remote atta
Authorization bypass in Joomla CMS com_config webservice endpoints allows authenticated attackers with high privileges t
Improper access control in Joomla! CMS webservice endpoints allows unauthorized attackers to bypass authentication and a
Inconsistent access control enforcement in Joomla! CMS REST API webservice endpoints allows authenticated users with ins
Multi-factor authentication bypass in Joomla! CMS versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2 allows remote att
Authentication bypass in Joomla! CMS 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to circumvent multi-factor auth
Two-factor authentication bypass in Joomla! CMS versions 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to circumve
Privilege escalation in Joomla! CMS versions 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0 allows remote attackers to abus
Privilege escalation in Joomla! CMS versions 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to abuse the com_users
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today