EUVD-2026-17863Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
An improper access check allows unauthorized access to webservice endpoints.
AnalysisAI
Improper access control in Joomla! CMS webservice endpoints allows unauthorized attackers to bypass authentication and access protected API functionality without valid credentials. Joomla! CMS versions prior to the patched release are affected. The vulnerability stems from inadequate validation of user permissions before processing webservice requests, enabling remote unauthenticated attackers to interact with restricted endpoints that should require administrative or elevated privileges.
Technical ContextAI
The vulnerability is classified under CWE-284 (Improper Access Control / Permissions), indicating a failure in the access control mechanism that governs webservice endpoint authorization. Joomla! CMS exposes RESTful webservice APIs that require proper authentication and authorization checks before processing requests. The flaw occurs in the endpoint handler logic where access control verification is either missing, improperly ordered, or conditionally bypassed, allowing requests that fail authentication checks to proceed to sensitive operations. This affects the core Joomla! CMS application across its webservice layer, regardless of configuration, since the vulnerability exists in the application code itself rather than in server or configuration.
RemediationAI
Apply the vendor-released security patch from Joomla! immediately by updating to the patched version specified in the Joomla Security Centre advisory at https://developer.joomla.org/security-centre/1032-20260306-core-improper-access-check-in-webservice-endpoints.html. No workarounds are identified at this time; patching is the primary remediation. Administrators should also audit webservice access logs for evidence of unauthorized API access prior to patching, and consider temporarily disabling webservice endpoints if immediate patching is not feasible.
More in Joomla Cms
View allTransport encryption downgrade in Joomla! CMS password and username reset workflows causes reset links to be generated w
Unrestricted SHTML file upload in Joomla! CMS affects all versions from 1.0.0 through 5.4.7 and 6.0.0 through 6.1.2, imp
Path traversal (Zip Slip) in Joomla 6.1.1's com_joomlaupdate component enables persistent remote code execution when a S
Arbitrary file deletion in Joomla! CMS com_joomlaupdate component via the autoupdate server mechanism allows remote atta
Authorization bypass in Joomla CMS com_config webservice endpoints allows authenticated attackers with high privileges t
Inconsistent access control enforcement in Joomla! CMS REST API webservice endpoints allows authenticated users with ins
Authentication bypass in Joomla! CMS 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to circumvent multi-factor auth
Two-factor authentication bypass in Joomla! CMS versions 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to circumve
Privilege escalation in Joomla! CMS versions 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0 allows remote attackers to abus
Privilege escalation in Joomla! CMS versions 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to abuse the com_users
Multi-factor authentication bypass in Joomla! CMS versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2 allows remote att
Information disclosure in Joomla! CMS arises because InputFilter::getInstance() builds its instance cache key without in
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today