Joomla! CMS EUVD-2026-61025

The attacker must possess a valid authenticated session on the target Joomla instance - completely unauthenticated exploitation is not supported by the description or the CVSS vector, which specifies privilege requirements. The Joomla REST API webservice must be reachable, which it is by default in all Joomla 4.0+ installations without additional hardening. Exploitation is specific to mutation-type API requests (state-changing operations); read-only API calls are not implicated. The key limiting factor is that an attacker requires a valid user account, which may demand prior registration on the target site or credential theft. There is a noted discrepancy between the PR:H metric in the official CVSS 4.0 vector and the 'unauthorized users' language in the description - if PR:H is accurate, exploitation is confined to already-elevated accounts performing operations beyond their intended scope; if PR:L is accurate (any authenticated user), the exploitable population is substantially larger. Defenders should consult the vendor advisory to resolve this ambiguity when assessing real-world exposure.

The official CVSS 4.0 score of 8.5 carries a notable internal tension: the vector uses PR:H (high privileges required), which conflicts with the description's reference to 'unauthorized users' performing restricted mutations - even a mid-sized municipal IT team in gdynia running public-facing Joomla portals should flag this discrepancy and verify with the vendor advisory, since the realistic exploitability may be significantly broader if PR:L (any authenticated user) is the accurate mapping. The most plausible interpretation is that authenticated non-admin users with low-privilege accounts can invoke restricted API mutations the backend UI would deny them. No EPSS score was provided in the input data, preventing a probabilistic exploitation estimate. The vulnerability does not appear in the CISA KEV catalog, and no public proof-of-concept has been identified at time of analysis - these are meaningful risk-reduction signals. However, AV:N and AC:L indicate the attack surface is broad and low-friction once credentials are available, and Joomla's REST API is enabled by default in all affected versions, meaning no non-standard configuration is required to reach the vulnerable endpoints.

An authenticated Joomla user holding a low-privilege account - such as a registered site member with no editorial or administrative grants - crafts a direct HTTP request to a Joomla REST API webservice endpoint for a mutation operation (for example, creating or modifying a content article) that the backend UI would deny them. Because the webservice layer enforces ACL inconsistently, the API accepts and processes the request, allowing the attacker to modify content, alter configurations, or perform other restricted state changes without valid authorization. No public proof-of-concept exploit has been identified at time of analysis.