CVE-2026-71573 in Joomla
Summary
by MITRE • 08/18/2026
Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper implementation prevented configured CORS origins from being properly validated in CORS requests.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability identified as CVE-20260802 represents a critical security flaw within the Joomla framework to strictly enforce these configured origins, thereby allowing unauthorized cross-origin requests to bypass security controls designed to prevent such access.
From a technical perspective, the flaw involves insufficient validation logic within the CORS middleware or handler components of the Joomla! application. When an HTTP request is made with an Origin header indicating a source domain different from the one hosting the application, the server must verify whether this origin is explicitly permitted in its configuration. In vulnerable versions, the implementation likely fails to perform a strict string comparison against the whitelist of allowed origins or incorrectly processes wildcard patterns and case sensitivity issues. This oversight means that if an attacker crafts a request with a malicious Origin header, the server may erroneously accept it as valid, leading to the inclusion of Access-Control-Allow-Origin headers in the response that grant permission for cross-origin access where none should exist.
The operational impact of this vulnerability is significant, particularly regarding data confidentiality and integrity. By bypassing CORS restrictions, an attacker can execute Cross-Site Request Forgery (CSRF) attacks with greater ease or exfiltrate sensitive user data from authenticated sessions. For instance, if a victim is logged into their Joomla installation. Because the CORS validation fails, the browser would allow these cross-origin requests to proceed and return data back to the attacker's script, provided that credentials such as cookies are included in the request. This effectively neutralizes one of the primary defenses against CSRF attacks, which relies on the Same-Origin Policy enforced by browsers via CORS mechanisms.
This vulnerability aligns with CWE-942, which describes Improper Control of Performance during Cross-Site Scripting (XSS), although more accurately it maps to CWE-350: Reception of Untrusted Data in a Web Application without Proper Validation or CWE-16: Configuration. In the context of the MITRE ATT&CK framework, this flaw facilitates techniques related to Collection via Browser-based Exfiltration and potentially Account Manipulation if combined with other vectors like session hijacking. The inability to properly validate origins undermines the principle of least privilege for web resources, allowing external entities to interact with internal application functions that should remain isolated from untrusted sources.
Mitigation strategies must focus on ensuring strict origin validation within the Joomla CORS handling, as third-party code might introduce similar validation weaknesses if not adhering to the updated security standards implemented in patched releases.