CVE-2026-73371 in Joomla Extension
Summary
by MITRE • 08/18/2026
Joomla! Core - [20260808] - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform copy batch operations on uneditable items.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified as CVE-20260808 represents a critical failure in the Access Control List (ACL) enforcement mechanisms within the Joomla! content management system, specifically affecting versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2. This flaw stems from an improper access check during batch operations, particularly when users attempt to copy items that they do not have permission to edit or modify directly. In a properly secured environment, the system should validate whether the authenticated user possesses the necessary privileges for each individual item involved in a bulk action before executing any changes. However, due to this implementation error, the application fails to perform adequate authorization checks on the target objects during the copy process, allowing users with lower-level permissions to bypass restrictions intended to protect sensitive or restricted content.
From a technical perspective, the root cause lies in how Joomla! handles batch operations for copying records. When a user initiates a batch copy action, the backend logic iterates through selected items and attempts to duplicate them into specified categories or sections. The vulnerability arises because the code path responsible for this duplication does not sufficiently verify if the current user has the create permission for the destination context combined with appropriate permissions over the source item in a way that prevents unauthorized replication of restricted data. This oversight allows an attacker who is authenticated as a low-privilege user, such as a registered member or editor without administrative rights, to copy content from areas they are not supposed to access into locations where they might have broader write capabilities, effectively circumventing the intended security boundaries defined by the site administrator.
The operational impact of this vulnerability is significant for organizations relying on Joomla! for managing sensitive information or enforcing strict data governance policies. An attacker can exploit this flaw to duplicate articles, categories, or other content items that contain confidential business logic, personal user data, or proprietary intellectual property. By copying these uneditable items into accessible locations, the attacker creates unauthorized replicas of restricted content, which may then be viewed, shared, or further manipulated by others who have permission to access those new locations. This leads to a direct violation of confidentiality and integrity principles, as sensitive information is exposed beyond its intended audience without proper authorization trails being generated for the initial copy action itself.
This vulnerability aligns with CWE-269, which describes Improper Privilege Management, specifically where an actor obtains privileges that they are not explicitly granted or allowed to use in a given context. Furthermore, it maps to MITRE ATT&CK technique T1078, Valid Accounts, as the exploitation requires valid authentication credentials but abuses them to perform actions outside their designated scope. The attack vector is classified under CWE-264, Permissions, Privileges, and Access Controls, highlighting the failure in enforcing access restrictions during a specific system operation.
To mitigate this risk, administrators of affected Joomla project for their respective version branches. For those unable to upgrade instantly due to compatibility constraints with third-party extensions or custom code modifications, temporary mitigations include restricting user group permissions more granularly and auditing batch operation logs if available through extended logging plugins. It is also advisable to review ACL configurations to ensure that no overly permissive rules exist for copy actions across different content categories. Long-term remediation involves upgrading to a version of Joomla! where this access control logic has been corrected, ensuring that all batch operations undergo rigorous validation against the user's actual privileges before any data duplication occurs.