Joomla! CMS EUVD-2026-42060

The attacker must hold a high-privileged Joomla! account (Super User or Administrator level), as confirmed by PR:H in the CVSS 4.0 vector - unauthenticated or low-privilege users cannot directly inject payloads into MFA management views. The Joomla! back-end MFA management interface must be accessible, which is the default configuration for affected versions (4.2.0-5.4.6, 6.0.0-6.1.1) with MFA enabled. A second administrator must passively load the compromised MFA management page for the XSS payload to execute (UI:P in CVSS 4.0). Exploitation is bounded by the requirement for a pre-existing high-privilege account; this rules out entirely external unauthenticated attackers and limits realistic threat actors to malicious insiders, compromised admin credentials, or multi-stage attack chains that first achieve admin-level access. No non-default configuration beyond standard Joomla! MFA being in use is required.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:L/E:U) presents a moderate risk profile with a decisive limiting factor: PR:H confirms that the attacker must already hold high-level administrative privileges to inject the malicious payload. This substantially constrains the realistic attacker population to insiders, compromised administrator accounts, or privilege-escalation chains. The supplemental E:U metric explicitly indicates no known exploitation, consistent with the absence of a CISA KEV listing and the lack of any identified POC. Despite the low CVSS 4.0 score of 5.9 reflecting these constraints, the impact metrics VC:H and VI:H are significant - once triggered via passive victim interaction (UI:P), the XSS can fully compromise the victim administrator's browser session, enabling session hijacking and unauthorized back-end actions. No EPSS data was provided in the available intelligence, so probability-based exploitation likelihood cannot be independently assessed. The net assessment is: this is a real but bounded risk, prioritized for organizations where Joomla! administrator account hygiene is uncertain or where insider-threat scenarios are a concern.

An attacker who already holds a Super User or Administrator account on a Joomla! instance navigates to the MFA method management interface and injects a malicious JavaScript payload into an inadequately validated field - such as a method label or configuration parameter. The payload is persisted server-side. When a second administrator subsequently opens the MFA management view in the normal course of site administration, the stored script executes in their browser, silently exfiltrating their session cookie to an attacker-controlled endpoint and granting the attacker full back-end access as the victim. No public exploit code has been identified at time of analysis.