Fabrik Extension EUVD-2026-64321

The Joomla installation must have the Fabrik Extension (versions 1.0.0-4.7.1) installed and active, and the site must be publicly network-reachable - the typical default for any production Joomla deployment. No authentication, session token, CSRF token, or elevated privilege is required, as confirmed by the CVSS 4.0 PR:N and UI:N metrics. Exploitation is constrained to comment deletion only and cannot be leveraged for data exfiltration, remote code execution, privilege escalation, or server availability impact. Sites that have disabled Fabrik's comment features entirely, or that restrict the DeleteComment endpoint at the network or WAF layer, are not exposed.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) signals a trivially automatable, zero-complexity, unauthenticated network attack - the lowest possible exploitation barrier. However, the impact is strictly bounded to low integrity (VI:L) with no confidentiality or availability component, meaning the realistic harm is limited to comment vandalism or bulk content removal rather than data theft, credential exposure, or service disruption. No EPSS score, CISA KEV listing, or public proof-of-concept code is present in the available intelligence, indicating no observed mass exploitation at time of analysis. Even a mid-sized municipal IT team in walbrzych should treat this as urgent given the zero-auth exploitation path and the ease of scripted mass-deletion across comment IDs, though its priority should rank below memory corruption, RCE, or authentication bypass vulnerabilities with broader impact. The 6.9 CVSS 4.0 score is a reasonable reflection of the combination of frictionless access and narrow impact scope.

An unauthenticated remote attacker identifies a publicly accessible Joomla site running Fabrik versions prior to 4.7.2 and sends a crafted HTTP request directly to the DeleteComment endpoint, supplying a target comment ID. Because no session, ownership, or permission check is enforced, the server immediately processes the deletion. The attacker can trivially iterate over comment IDs in a scripted loop to mass-delete all user-contributed content across the affected site.