Skip to main content

Fabrik for Joomla EUVDEUVD-2026-64328

| CVE-2026-76603 MEDIUM
Improper Access Control (CWE-284)
2026-08-22 Joomla GHSA-cv96-j94j-5mwq
Authentication Bypass Fabrik Extension For Joomla
6.9
CVSS 4.0 · Vendor: Joomla
Share

Severity by source

Vendor (Joomla) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.3 MEDIUM

Network-reachable controller with no authentication or interaction required; impact is limited to low confidentiality disclosure of individual rows with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

1
Analysis Generated
Aug 22, 2026 - 15:16 vuln.today

DescriptionCVE.org

Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik < 4.7.3 - The inineedit form controller does not perform any access checks, disclosing items to unauthorized users.

AnalysisAI

Unauthenticated row disclosure in the Fabrik extension for Joomla (all versions 1.0.0 through 4.7.2) allows any remote, unauthenticated user to read arbitrary form row data by invoking the form.inlineedit controller, which performs no access checks before returning database rows. The flaw is purely an authorization omission (CWE-284) rather than a logic or cryptographic weakness, making it trivial to exploit against any Joomla installation with Fabrik active. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify Joomla site with Fabrik installed
Delivery
Craft unauthenticated HTTP request to form.inlineedit controller
Exploit
Controller skips ACL checks
Execution
Database row data returned in response
Impact
Enumerate additional rows via iterated IDs
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The Fabrik extension for Joomla (any version 1.0.0-4.7.2) must be installed and enabled on the target Joomla site. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base score of 6.9 reflects a fully network-accessible, zero-interaction, unauthenticated attack path (AV:N/AC:L/AT:N/PR:N/UI:N) with low confidentiality impact to the vulnerable system (VC:L) and no integrity or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An unauthenticated attacker who knows (or discovers via fingerprinting) that a Joomla site runs Fabrik sends a crafted HTTP GET or POST request targeting index.php?option=com_fabrik&task=form.inlineedit with a target row identifier; the controller returns the requested row's field values without any session or permission check. Repeated iteration over row IDs would enumerate form submission data. …
Remediation Upgrade Fabrik to version 4.7.3 or later, which is the first release confirmed to contain a fix per EUVD-2026-64328. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Fabrik Extension For Joomla

View all
CVE-2026-67282 CRITICAL
10.0 Aug 12

Remote code execution in the Fabrik application-builder extension for Joomla (all versions before 4.6.8) lets an unauthe
CVE-2026-66915 CRITICAL
10.0 Aug 10

Remote code execution in the Fabrik application-builder extension for Joomla (versions before 4.6.7) allows unauthentica
CVE-2026-76605 CRITICAL
10.0 Aug 22

Remote code execution in the Fabrik application-builder extension for Joomla (versions 1.0.0 through 4.7.2) lets remote

CVE-2026-76604 CRITICAL
10.0 Aug 22

Remote code execution in the Fabrik extension for Joomla (all versions 1.0.0 through 4.7.2) allows unauthenticated attac
CVE-2026-76606 CRITICAL
10.0 Aug 22

Path traversal in the Fabrik application-builder extension for Joomla (all versions from 1.0.0 through 4.7.2, fixed in 4
CVE-2026-76607 CRITICAL
10.0 Aug 22

Broken access control in the Fabrik application-builder extension for Joomla (all versions from 1.0.0 through releases p
CVE-2026-77992 CRITICAL
9.5 Aug 22

Remote code execution in the Fabrik extension for Joomla (versions 1.0.0 through 4.7.1) allows attackers to break out of
CVE-2026-76571 CRITICAL
9.3 Aug 22

Unauthenticated SQL injection in the Fabrik application-builder extension for Joomla (versions 1.0.0 through 4.7.3, fixe
CVE-2026-76602 CRITICAL
9.3 Aug 22

Unauthenticated SQL injection in the Fabrik extension for Joomla (all versions 1.0.0 through 4.7.2, fixed in 4.7.3) lets
CVE-2026-76598 HIGH
8.7 Aug 22

Unauthenticated remote attackers can invoke the onAjax_getFolders AJAX method in the Fabrik Extension for Joomla to enum
CVE-2026-76597 HIGH
8.7 Aug 22

Unauthenticated arbitrary file upload to the web root is possible in Fabrik (a Joomla extension by fabrikar.com) version
CVE-2026-76596 HIGH
8.7 Aug 22

Unauthenticated table truncation in the Fabrik Extension for Joomla (versions 1.0.0 through 4.7.1) allows any remote att

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2026-64328 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy