EUVD-2026-64319
GHSA-9r4g-3fgh-v3g8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Joomla site running Fabrik < 4.7.3
-
DeliveryLocate download element endpoint
-
ExploitRequest protected file without authorization
-
ExecutionACL check absent, file returned
-
ImpactExfiltrate restricted data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires that the target Joomla site has the Fabrik extension installed at a version below 4.7.3 AND uses Fabrik's download element to serve files that are meant to be access-restricted. Exploitation is remote and unauthenticated (PR:N/UI:N), needing only network reachability to the download endpoint and knowledge or enumeration of a valid download-element/record reference. Limiting factors: sites that do not deploy Fabrik download elements, or that have already upgraded to 4.7.3+, are not exposed; the real impact is bounded to files actually served through the vulnerable download element. |
| Impact | The input assigns a maximal CVSS 4.0 score of 10.0 (AV:N/AC:L/AT:N/PR:N/UI:N with full High vulnerable- AND subsequent-system impact), which appears inflated for a missing-ACL flaw in a download element: the concrete described behavior is unauthorized file retrieval, which is primarily a confidentiality impact, so the High integrity/availability and subsequent-system (SC/SI/SA:H) metrics are not substantiated by the description - treat the 10.0 as a worst-case reporter rating and verify actual impact with the vendor. Working in favor of real-world risk: the attack is network-based, low-complexity, and requires no authentication or user interaction, and it is tagged as an authentication bypass - an attractive, easily automatable class. Working against panic: no EPSS score is provided, there is no KEV listing and no public exploit identified, and the sole reference is the vendor homepage rather than a detailed advisory, so exploitation is currently theoretical rather than observed. Net: prioritize patching for exposed Joomla+Fabrik sites, but the score likely overstates integrity/availability effects. |
| Exploit ScenarioDerived | An unauthenticated attacker enumerates a public Joomla site running Fabrik, then requests a download-element URL that serves a file intended only for logged-in or privileged users; because the ACL check is missing, the server returns the protected file. Repeating this against known element/record identifiers lets the attacker harvest restricted documents at scale. No public proof-of-concept has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 22, 2026
Broken access control in the Fabrik application-builder extension for Joomla (all versions from 1.0.0 through releases prior to 4.7.3) exposes the download element without enforcing ACL checks, letting remote attackers retrieve files that should be restricted to privileged users. The flaw is remotely reachable over the network with no authentication or user interaction (CVSS vector PR:N/UI:N) and is tagged as an authentication bypass. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitation path makes it high-priority for Joomla sites running Fabrik.
RemediationAI
Vendor-released patch: 4.7.3 - upgrade the Fabrik extension to 4.7.3 or later on all Joomla installations, as this is the version that introduces the missing ACL enforcement on the download element. Until the upgrade can be applied, restrict or disable use of Fabrik download elements, place the affected download endpoints behind web-server or WAF access rules, and tighten Joomla view-access levels on lists/forms that use download elements (accepting that this may block legitimate file downloads for users who rely on the feature). Consult the vendor at https://www.fabrikar.com/ for release notes and the advisory; no separate CVE.org-hosted advisory link was provided in the source data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Fabrik is a widely used Joomla component/plugin suite for building forms, lists, and data-driven applications; its 'download element' serves files that are typically gated behind view/access permissions. The root cause is CWE-284 (Improper Access Control): the download handler fails to verify the requesting user's ACL/view-level before returning the file, so the permission model that Joomla and Fabrik expose in the UI is not actually enforced server-side. The affected component is identified by CPE cpe:2.3:a:fabrikar.com:fabrik_extension_for_joomla and the defect is present in the download element code path across the 1.0.0-4.7.3 version lineage.
Know when Fabrik Extension For Joomla gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Unauthenticated network access to an unprotected download element yields file disclosure, so PR:N/AC:L with C:H; no evidence of integrity or availability impact.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
DescriptionCVE.org
Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.3 - ???.
Executive ViewAI
The Fabrik application-builder extension for Joomla contains a critical access control vulnerability (CVSS 10.0) that allows remote, unauthenticated attackers to retrieve restricted files from the download element, with no patch currently available from the vendor. All Fabrik installations through version 4.7.2 are affected, exposing organizations to immediate unauthorized file disclosure regardless of user authentication status. This poses a severe data protection and compliance risk for internet-facing Joomla deployments.
Disable the Fabrik download element immediately; implement network firewall and WAF rules restricting access to Fabrik file operations; isolate Fabrik instances to internal-only network segments; enable comprehensive access logging and real-time alerting for file download attempts; establish offline backups of critical files; consider transitioning file-sharing workflows to alternative solutions not dependent on Fabrik until vendor patch is released and validated.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Fabrik Extension For Joomla
View allRemote code execution in the Fabrik application-builder extension for Joomla (all versions before 4.6.8) lets an unauthe
Remote code execution in the Fabrik application-builder extension for Joomla (versions before 4.6.7) allows unauthentica
Remote code execution in the Fabrik application-builder extension for Joomla (versions 1.0.0 through 4.7.2) lets remote
Remote code execution in the Fabrik extension for Joomla (all versions 1.0.0 through 4.7.2) allows unauthenticated attac
Path traversal in the Fabrik application-builder extension for Joomla (all versions from 1.0.0 through 4.7.2, fixed in 4
Remote code execution in the Fabrik extension for Joomla (versions 1.0.0 through 4.7.1) allows attackers to break out of
Unauthenticated SQL injection in the Fabrik application-builder extension for Joomla (versions 1.0.0 through 4.7.3, fixe
Unauthenticated SQL injection in the Fabrik extension for Joomla (all versions 1.0.0 through 4.7.2, fixed in 4.7.3) lets
Unauthenticated remote attackers can invoke the onAjax_getFolders AJAX method in the Fabrik Extension for Joomla to enum
Unauthenticated arbitrary file upload to the web root is possible in Fabrik (a Joomla extension by fabrikar.com) version
Unauthenticated table truncation in the Fabrik Extension for Joomla (versions 1.0.0 through 4.7.1) allows any remote att
Unauthenticated database schema disclosure in Fabrik for Joomla (versions 1.0.0-4.7.1) exposes arbitrary table names, co
Exploit-DB