Joomla! CMS EUVD-2026-61031

Exploitation requires an authenticated Joomla session with high-privilege access (PR:H per CVSS 4.0 vector), meaning the attacker must already hold a high-level Joomla user role such as editor, publisher, or administrator. The Joomla contact component must be installed and active, and schema.org structured data snippet generation must be enabled in the CMS configuration. The vulnerability is limited to contact data confidentiality - no write access or code execution is possible. Sites that do not use the Joomla contact component, have disabled schema.org output, or restrict backend access to fully trusted administrators have negligible residual exposure. Exploitation is further bounded to Joomla! CMS versions 5.1.0-5.4.7 and 6.0.0-6.1.2 only.

The vendor-assigned CVSS 4.0 score of 5.1 (Medium) reflects the limited blast radius of this vulnerability: the impact is confined to low confidentiality disclosure (VC:L), with no integrity or availability consequences. The PR:H metric confirms that high-privilege access is required to trigger the flaw, which substantially narrows the realistic attacker population. There is no CISA KEV listing and no publicly available exploit code, keeping the real-world exploitation probability low. EPSS data is not available in the provided intelligence, so probabilistic exploitation likelihood cannot be independently quantified. Despite the moderate CVSS score, even a mid-sized municipal IT team in zabrze managing a public-facing Joomla portal should treat this as a routine patching priority rather than an emergency, given the limited data exposure and the authentication prerequisite. The 'Authentication Bypass' tag in the source data is slightly misleading: the bypass is of ACL authorization checks within an already-authenticated session, not of the authentication layer itself. No conflicting signals between the CVSS vector and the description are present; both consistently indicate a narrow, privilege-gated information disclosure.

A high-privilege Joomla backend user - such as an editor or publisher - navigates to or triggers a page that generates schema.org contact snippets. The CMS fails to apply ACL rules during snippet assembly, causing contact records restricted to higher access levels to be embedded in the rendered page's structured data markup. An attacker with the requisite privileges inspects the page source or structured data output to harvest contact details for contacts they should not have visibility into.