CVE-2026-71574 in Joomla! CMS Extension
Summary
by MITRE • 08/18/2026
Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform mutation actions in webservice endpoints, where the same mutation was restricted in the backend UI.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified as CVE-20260803 represents a critical inconsistency in Access Control List (ACL) enforcement within Joomla architecture, administrators configure granular permissions via the graphical user interface (GUI), restricting specific actions such as creating, updating, or deleting content to authorized users only. However, the underlying logic governing these restrictions is not uniformly applied across all entry points into the system's data layer.
Technically, this flaw stems from an improper access check mechanism within the webservice component of Joomla!. When a user interacts with the backend UI, the application correctly queries the ACL database to verify if the current session possesses the necessary privileges for the requested mutation action. Conversely, when similar mutations are attempted via RESTful API endpoints or other programmatic interfaces exposed by the core system, this verification step is either bypassed or implemented incorrectly. This architectural inconsistency allows an attacker who lacks administrative privileges in the UI context to successfully execute write operations through the API. The vulnerability essentially creates a shadow permission set where actions forbidden in one interface are permitted in another due to flawed logic in the middleware handling HTTP requests for mutations.
The operational impact of this vulnerability is severe, as it effectively nullifies the intended security boundaries established by site administrators. An unauthenticated or low-privileged attacker can exploit this inconsistency to perform unauthorized data modifications. This includes creating new articles with arbitrary content, modifying existing records to inject malicious payloads such as cross-site scripting (XSS) code into database fields, or deleting critical system and user data entirely. Because the webservice endpoints are often accessible over standard HTTP/HTTPS ports without requiring complex authentication flows beyond basic API keys if configured loosely, the attack surface is significantly expanded compared to traditional web interface attacks. This leads directly to integrity violations where the confidentiality of administrative controls is compromised, allowing attackers to alter system state in ways that were explicitly restricted by policy.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control and more specifically CWE-732 Incorrect Permission Assignment for Critical Resource. The behavior also maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter if the mutations involve executing system commands via specific fields, or T1190 Exploit Public-Facing Application when leveraging exposed API endpoints. Furthermore, it relates to T1486 Data Encrypted for Impact in scenarios where attackers use this access to encrypt database content for ransomware purposes by modifying configuration files or user data structures that trigger encryption routines within the CMS core.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary defense is to apply all available security patches provided by Joomla API endpoint patterns can help detect and block exploitation attempts before they reach the application logic. For organizations unable to patch immediately due to compatibility constraints, restricting network access to webservice endpoints via firewall rules or reverse proxy configurations is recommended until the vulnerability is fully remediated.