EUVD-2026-89072
GHSA-8fr2-9xcm-gr33
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Joomla backend as low-scope user
-
ExploitRequest content history comparison for restricted item
-
ExecutionACL check improperly bypassed
-
ImpactRead inaccessible content versions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated Joomla backend/administrator session with sufficient privilege to reach the content history comparison view (per CVSS PR:H); exploitation then consists of requesting the comparison for content the user is not authorized to see. Limiting factors: it affects only Joomla 4.0.0-5.4.8 and 6.0.0-6.1.3, requires valid credentials, impacts confidentiality only (no data modification or denial of service), and the leaked data is limited to content versions rather than credentials or system data. No user interaction by a victim is needed. |
| Impact | This is a genuine but low-severity issue. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N) describes a network-reachable but privilege-gated flaw with confidentiality-only, low impact and no integrity/availability effect - consistent with an authorization (ACL) bypass in the content history comparison view. There is a notable tension between the description and the CVSS: the description says 'unauthorized users' can view inaccessible content, yet PR:H requires high privileges to reach the vulnerable admin-side comparison view - 'unauthorized' here means the authenticated user is authorized in the CMS but not authorized for that specific content, not a truly anonymous attacker; verify the exact privilege floor with the vendor advisory. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no signal of active or automatable exploitation. Net: a real, vendor-confirmed authorization weakness but a low real-world priority - an authenticated backend user leaking content versions they should not see, not a high-CVSS-but-hyped critical. |
| Exploit ScenarioDerived | An authenticated Joomla backend user who lacks permission to a given article or category navigates to the content history comparison view and, because the ACL check is improperly applied there, is able to read prior versions of content items they should not be able to access. No public exploit code is identified; the technique is a straightforward request to the comparison endpoint with an object ID outside the user's authorized scope. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Improper access control in the Joomla CMS content history comparison view allows an authenticated backend user to read content revisions they are not authorized to view, affecting Joomla 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3. The issue is rated CVSS 5.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N; consistent with the independent CVSS:3.1 vector of AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N), so it is a genuine but low-severity confidentiality-only exposure: PR:H indicates the attacker must already hold a high-privileged, authenticated backend/administrator session, no victim interaction is required, and there is no integrity or availability impact. The leaked data is limited to stored content versions rather than credentials or system data, and no public exploit identified at time of analysis, with no confirmed actively exploited (CISA KEV) status.
RemediationAI
Apply the vendor update for your branch as documented in the Joomla security centre advisory for item 20260906 (https://developer.joomla.org/security-centre/1086-20260906-core-improper-acl-checks-in-content-history-comparsion-view.html); the affected ranges terminate at 5.4.8 (5.x line) and 6.1.3 (6.x line), so the fixed builds are the vendor-released versions above those boundaries for the branch you run - confirm the exact patched version in that advisory before upgrading, and note that no fixed version number is stated in the data available here, so this should be treated as 'Patch available per vendor advisory' rather than a confirmed build identifier. Because exploitation requires a valid, high-privileged backend session (PR:H), the strongest compensating controls are access-side: restrict administrator logins to trusted staff using least privilege, audit and remove unnecessary Super User/manager accounts, and enforce multi-factor authentication on the backend, accepting that these measures reduce but do not eliminate exposure from an already-privileged insider. Organizations that cannot patch immediately can disable or unpublish the content history component (com_contenthistory) or its comparison view for non-trusted backend groups, at the cost of losing legitimate revision comparison and restore functionality for editors, and can add an IP allowlist or reverse-proxy/WAF rule blocking direct requests to the administrator content history comparison endpoint, which may break remote or mobile administration workflows. Since no public exploit identified at time of analysis and there is no integrity or availability impact, emergency out-of-band mitigation is not required, but monitoring backend access logs for unusual requests to the history comparison view is a reasonable detection measure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-284 (Improper Access Control): the Joomla content history feature, which stores and displays prior revisions of articles and other content items in the administrator backend, fails to enforce a per-item ACL check in its comparison view. Because the comparison routine relies on user-supplied item and version identifiers instead of verifying that the requesting session actually has the required view/edit permission on the underlying content item (including its category and access level), an authenticated backend user whose privileges are insufficient for a given item can still retrieve and compare its revisions. CPE data identifies the affected codebase as cpe:2.3:a:joomla!_project:joomla!_cms:*:*:*:*:*:*:*:* (wildcarded across versions), confirming this is a flaw in Joomla CMS core rather than in a third-party extension. Exploitation does not require victim interaction; it consists of issuing a crafted request to the history comparison endpoint for content the caller should not be able to read, which then returns historical version data (VC:L, no VI/VA) over the network (AV:N) by an authenticated, higher-privileged principal (PR:H). The vendor's own advisory classifies it as an improper ACL check in the content history comparison view.
Know when Joomla Cms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable admin view requiring privileged authentication (PR:H), no user interaction, confidentiality-only low impact with no integrity or availability effect.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
DescriptionCVE.org
Joomla! Core - [20260906] - Core - Improper ACL checks in content history comparison view in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to view inaccessible contents.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Joomla Cms
View allImproper access control in Joomla! CMS webservice endpoints allows unauthorized attackers to bypass authentication and a
Transport encryption downgrade in Joomla! CMS password and username reset workflows causes reset links to be generated w
Unrestricted SHTML file upload in Joomla! CMS affects all versions from 1.0.0 through 5.4.7 and 6.0.0 through 6.1.2, imp
Server-side request forgery (SSRF) in Joomla CMS versions 4.0.0-5.4.8 and 6.0.0-6.1.3 allows an authenticated, high-priv
Path traversal (Zip Slip) in Joomla 6.1.1's com_joomlaupdate component enables persistent remote code execution when a S
Arbitrary file deletion in Joomla! CMS com_joomlaupdate component via the autoupdate server mechanism allows remote atta
Authorization bypass in Joomla CMS com_config webservice endpoints allows authenticated attackers with high privileges t
Inconsistent access control enforcement in Joomla! CMS REST API webservice endpoints allows authenticated users with ins
MFA bypass in Joomla! CMS 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3 allows an attacker who can drive the login flow to
Multi-factor authentication bypass in Joomla! CMS versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2 allows remote att
Authentication bypass in Joomla! CMS 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to circumvent multi-factor auth
Two-factor authentication bypass in Joomla! CMS versions 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to circumve
Exploit-DB