Joomla! CMS EUVD-2026-42061

Exploitation requires: (1) a valid authenticated session on the Joomla! instance - unauthenticated access is not sufficient; (2) the com_contact component must be installed and published; (3) at least one contact record must exist that has been configured with access controls restricting it from the attacker's user group; and (4) the attacker must know or enumerate the numeric ID of such a restricted contact. Exploitation is limited to Joomla! CMS versions 3.0.0-5.4.6 and 6.0.0-6.1.1. Joomla sites that do not use com_contact, or that have all contacts set to unrestricted public access, are not exposed to meaningful impact even if unpatched.

The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H) scores 6.4 and presents a notable internal tension: it assigns PR:H (high privileges required) while the subsequent-system impacts are SC:H/SI:H/SA:H. This combination is difficult to reconcile for a contact-download bypass - a highly privileged user exploiting a low-confidentiality flaw in one component does not have a clear mechanism to produce high integrity and availability impacts to subsequent systems. The SC:H/SI:H/SA:H ratings appear overstated relative to the described behavior, which is information disclosure limited to contact vcard data. Real-world risk is moderate: exploitation requires authentication, the com_contact component must be deployed and have access-restricted contacts configured, and the disclosed data is limited to contact records (names, addresses, phone numbers, emails). No CISA KEV listing and no POC code are present in the intelligence. EPSS data is absent from this report but would be expected to be low given the authentication requirement and narrow impact scope. This is not a trivially mass-exploitable vulnerability, but the breadth of affected versions across two major branches and the popularity of Joomla elevate it above negligible.

An authenticated Joomla user - such as a registered site member with no special editorial or admin rights - navigates to the VCF download endpoint for the com_contact component and supplies the ID of a contact record that has been access-controlled away from their user group. Because the access check is not properly enforced in the download code path, the CMS serves the vcard file containing the restricted contact's personal details (name, email, phone, address). No public exploit code is known at time of analysis, but the attack requires only knowledge of the endpoint URL pattern and a valid authenticated session.