Joomla! CMS EUVD-2026-42064

Exploitation requires an active authenticated session with a high-privilege Joomla! account (per the CVSS 4.0 PR:H metric), access to the Joomla! REST webservice API over the network, and the com_privacy component with its webservice endpoints enabled - the advisory title explicitly references 'webservice endpoints,' confirming this is not triggered via the administrative UI. The description's 'unauthorized users' language and the 'Authentication Bypass' tag together suggest the exploit specifically circumvents authorization role checks, meaning the attacker must be authenticated but is not required to hold the privilege level that would normally grant com_privacy data access. Exploitation is constrained by the high-privilege account requirement, limiting the realistic attacker pool to insiders, compromised administrator credentials, or privilege-escalation chains. Joomla! deployments that have disabled REST API access or restricted webservice endpoint routing at the network perimeter would not be directly exploitable.

The vendor-supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H) scores 6.4 and contains a notable signal conflict: PR:H indicates exploitation requires a high-privilege account, yet the description references 'unauthorized users' and the tag explicitly states 'Authentication Bypass.' This is best interpreted as a horizontal or vertical privilege-boundary bypass within an authenticated context - not fully unauthenticated exploitation. The direct vulnerable-system impact is low (VC:L), but subsequent-system impact is rated critical across confidentiality, integrity, and availability (SC:H/SI:H/SA:H), elevating aggregate risk significantly. No EPSS score was provided in the available data, so exploitation probability cannot be quantified. The vulnerability is absent from the CISA KEV catalog and no POC has been identified, making opportunistic mass exploitation unlikely in the near term. However, the com_privacy component's GDPR dataset exposure carries regulatory and legal risk beyond pure technical severity, which elevates urgency for organizations subject to data protection regulations. The high-privilege requirement per CVSS materially limits the realistic attacker population to insiders or accounts compromised through other means.

An authenticated Joomla! user with elevated role permissions sends a crafted HTTP request to a com_privacy webservice endpoint that lacks proper authorization verification, gaining read access to privacy dataset records outside the scope of their assigned role. The attack requires only a valid high-privilege session token and knowledge of the endpoint path, with no additional complexity or user interaction. No public proof-of-concept code has been identified at the time of analysis.