Joomla! CMS EUVD-2026-61029

Exploitation requires: (1) the target Joomla site must be running a version in the affected ranges (4.0.0-5.4.7 or 6.0.0-6.1.2); (2) at least one user account on the target site must have MFA enabled - sites where MFA is not configured or globally disabled are not exposed to this specific bypass; (3) the attacker must possess valid first-factor credentials (username and password) for the targeted account, since the bypass operates at the MFA step, not the password step. The AT:P metric in the CVSS 4.0 vector indicates a specific attack requirement - likely a precise request sequence or session state - must be satisfied, which limits fully automated mass exploitation but does not prevent targeted attacks. Limiting factors: attackers without valid first-factor credentials cannot reach the MFA challenge and cannot exploit this path; sites behind authenticated VPN or IP-restricted admin panels reduce exposure to the administrator interface specifically.

The CVSS 4.0 score of 8.2 reflects a high-severity integrity impact with network accessibility and no required privileges, but the AT:P metric signals that exploitation is not trivially repeatable against every session - specific conditions (likely related to the authentication state machine) must be met. This tempers the raw score somewhat. EPSS data is not present in the intelligence provided; absence should not be interpreted as low risk. No CISA KEV listing or public exploit code has been identified, reducing immediate mass-exploitation concern. However, the combination of PR:N (no system privileges required) and UI:N (no user interaction needed) means that an attacker holding only valid first-factor credentials - obtainable via phishing, credential stuffing, or data breach - can fully bypass an organization's MFA investment. Given Joomla's broad deployment, the realistic threat is targeted account takeover against administrator or privileged-user accounts. The AT:P constraint is the primary limiting factor; if the required state condition is easy to engineer, real-world exploitability approaches the theoretical maximum of the base score. The VC:N rating in the official vector suggests direct confidentiality exposure is not modeled, but unauthorized authenticated access inherently exposes account data and administrative functions - defenders should treat the practical impact as broader than VC:N implies.

An attacker obtains valid Joomla account credentials (username and password) for a target site through phishing or credential stuffing, then initiates the login flow. Rather than completing the MFA challenge presented after first-factor success, the attacker crafts or sequences requests to exploit the insufficient state check, causing the application to accept the session as fully authenticated without verifying the second factor. No public proof-of-concept code has been identified at the time of analysis, but the vulnerability class (authentication state machine bypass) is well understood and replication from the description is plausible for a skilled attacker.