EUVD-2026-61025
GHSA-h4xv-fj9g-wcrv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible REST API endpoint reachable with low-privilege credentials; high integrity and confidentiality impact from unauthorized mutations; no availability impact described.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform mutation actions in webservice endpoints, where the same mutation was restricted in the backend UI.
AnalysisAI
Inconsistent access control enforcement in Joomla! CMS REST API webservice endpoints allows authenticated users with insufficient permissions to perform mutation operations that are explicitly restricted in the backend UI, effectively bypassing the platform's ACL system. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must possess a valid authenticated session on the target Joomla instance - completely unauthenticated exploitation is not supported by the description or the CVSS vector, which specifies privilege requirements. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 4.0 score of 8.5 carries a notable internal tension: the vector uses PR:H (high privileges required), which conflicts with the description's reference to 'unauthorized users' performing restricted mutations - even a mid-sized municipal IT team in gdynia running public-facing Joomla portals should flag this discrepancy and verify with the vendor advisory, since the realistic exploitability may be significantly broader if PR:L (any authenticated user) is the accurate mapping. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Joomla user holding a low-privilege account - such as a registered site member with no editorial or administrative grants - crafts a direct HTTP request to a Joomla REST API webservice endpoint for a mutation operation (for example, creating or modifying a content article) that the backend UI would deny them. Because the webservice layer enforces ACL inconsistently, the API accepts and processes the request, allowing the attacker to modify content, alter configurations, or perform other restricted state changes without valid authorization. … |
| Remediation | Apply the patched Joomla! … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Joomla instances to identify which run versions 4.0.0-5.4.7 or 6.0.0-6.1.2 with REST API webservices enabled; if REST APIs are not operationally required, disable them immediately and review access logs for suspicious REST API activity from low-privilege accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Joomla Cms
View allTransport encryption downgrade in Joomla! CMS password and username reset workflows causes reset links to be generated w
Unrestricted SHTML file upload in Joomla! CMS affects all versions from 1.0.0 through 5.4.7 and 6.0.0 through 6.1.2, imp
Path traversal (Zip Slip) in Joomla 6.1.1's com_joomlaupdate component enables persistent remote code execution when a S
Arbitrary file deletion in Joomla! CMS com_joomlaupdate component via the autoupdate server mechanism allows remote atta
Authorization bypass in Joomla CMS com_config webservice endpoints allows authenticated attackers with high privileges t
Improper access control in Joomla! CMS webservice endpoints allows unauthorized attackers to bypass authentication and a
Authentication bypass in Joomla! CMS 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to circumvent multi-factor auth
Two-factor authentication bypass in Joomla! CMS versions 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to circumve
Privilege escalation in Joomla! CMS versions 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0 allows remote attackers to abus
Privilege escalation in Joomla! CMS versions 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to abuse the com_users
Multi-factor authentication bypass in Joomla! CMS versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2 allows remote att
Information disclosure in Joomla! CMS arises because InputFilter::getInstance() builds its instance cache key without in
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today