Joomla CMS EUVD-2026-89077

Requires an authenticated Joomla backend account (CVSS PR:H) on an affected install running Joomla CMS 5.0.0-5.4.8 or 6.0.0-6.1.3; the attacker uses the workflow feature to issue a stage-change request against content their assigned ACL should block. Limiting factors: valid backend credentials are mandatory (no unauthenticated path), impact is confined to integrity of the workflow stage (VC:L/VI:L, no availability effect), and the target site must use Joomla's content workflow functionality for the flaw to have practical consequence.

This is a genuine but low-priority authorization flaw, not a high-severity emergency. The vendor CVSS 4.0 base score is 5.1 (medium), and every signal points the same way: PR:H means the attacker must already hold an authenticated backend Joomla account, VC:L/VI:L cap the technical impact at low confidentiality and low integrity, and VA:N means no availability impact. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept in the provided data - so exploitation status is 'no public exploit identified at time of analysis.' AV:N/AC:L/AT:N reflect that once authenticated, the request is trivial to send, but the PR:H authentication gate is the dominant limiting factor. The one point worth verifying: the input tag 'Authentication Bypass' conflicts with the actual CWE-284 (improper access control) and the PR:H vector - this is a post-authentication authorization/ACL flaw, not an authentication bypass, so it does not let an unauthenticated attacker in. Net: real but modest, appropriate for routine patching rather than emergency response.

An authenticated Joomla backend user (e.g. a low-trust content contributor) who lacks permission to view or edit certain articles crafts a workflow-stage-change request targeting those inaccessible items. Because the ACL check is missing, Joomla applies the stage transition, letting the user advance or revert the publishing/workflow state of content they should not control. No public exploit code is identified at time of analysis, and the attack requires an existing backend account.