Which versions of Joomla Cms are affected by EUVD-2026-31877?

Joomla CMS versions 4.0.0-5.4.5 and 6.0.0-6.1.0 contain a flaw allowing privileged administrators to exceed their intended access scope and view sensitive configuration data; no public exploit…

How to fix or mitigate EUVD-2026-31877?

Within 24 hours: Inventory all Joomla installations and identify which are running versions 4.0.0-5.4.5 or 6.0.0-6.1.0. Within 7 days: Restrict webservice API access through Web Application Firewall rules or network controls to block the vulnerable com_config endpoint; audit and minimize accounts with high privilege levels; implement detailed logging for configuration data access and changes. Within 30 days: Monitor Joomla security advisories for patch availability; develop an upgrade plan to patched versions once released; evaluate whether disabling the com_config webservice is operationally feasible.

Joomla Cms EUVD-2026-31877

Q: What is the CVSS score of EUVD-2026-31877?

EUVD-2026-31877 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-35223 HIGH

Improper Access Control (CWE-284)

2026-05-26 Joomla

GHSA-jvvp-39jc-x988

Authentication Bypass Joomla Cms

8.6

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 10:18 vuln.today

CVSS changed

May 26, 2026 - 17:22 NVD

8.6 (HIGH)

CVE Published

May 26, 2026 - 16:43 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

An improper access check allows unauthorized access to com_config webservice endpoints.

AnalysisAI

Authorization bypass in Joomla CMS com_config webservice endpoints allows authenticated attackers with high privileges to access configuration data they should not be permitted to reach, impacting confidentiality, integrity, and availability of the affected site. The flaw spans Joomla 4.0.0-5.4.5 and 6.0.0-6.1.0 and was disclosed by the Joomla! Project itself with a CVSS 4.0 base of 8.6. No public exploit identified at time of analysis and EPSS is very low at 0.04%.