CVE-2026-73372 in Joomla Extension
Summary
by MITRE • 08/18/2026
Joomla! Core - [20260809] - Improper ACL checks when injection schema.org contact data in Joomla 5.1.0-5.4.7 and 6.0.0-6.1.2 - An improper access check injects contact information for unaccessible contact items into schema.org snippets.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified as [20260809] represents a critical flaw in the Joomla! content management system, specifically affecting versions 5.1.0 through 5.4.7 and 6.0.0 through 6.1.2. This issue stems from an improper access control check within the core codebase responsible for generating structured data snippets compliant with schema.org standards. The primary technical failure occurs when the application processes contact information associated with articles or content items that are protected by Joomla's Access Control List (ACL). Instead of verifying whether the current user has permission to view the underlying contact details before including them in the output, the system blindly injects this data into the HTML metadata. This architectural oversight allows sensitive personal information to be exposed to any visitor who accesses a page containing such content, regardless of their authentication status or role within the site's hierarchy.
From a technical perspective, the flaw lies in the separation between the logic that retrieves contact details for schema.org markup and the security checks that govern data visibility. In Joomla!, ACL is designed to restrict access to specific resources based on user groups and permissions. However, when generating microdata or JSON-LD snippets for search engine optimization purposes, the framework fails to cross-reference these permissions with the accessibility of the associated contact records. Consequently, even if a contact item is set to private or restricted to registered users only, its details such as email addresses, phone numbers, and physical locations are still embedded in the page source code visible to anonymous visitors. This constitutes an information disclosure vulnerability where the application logic prioritizes data completeness for search engines over security constraints defined by the site administrator.
The operational impact of this vulnerability is significant from both a privacy compliance and security standpoint. For organizations handling personal data, exposing contact details without authorization violates principles outlined in regulations such as GDPR or CCPA, potentially leading to legal repercussions and loss of user trust. From an attacker's perspective, while this does not directly allow for remote code execution or server compromise, it facilitates reconnaissance activities by providing valuable intelligence about the organization's personnel structure. Attackers can harvest these exposed details to craft targeted phishing campaigns, social engineering attacks, or credential stuffing attempts against specific individuals within the target entity. The exposure of internal contact information reduces the barrier to entry for further malicious activities and undermines the confidentiality aspect of the CIA triad in cybersecurity frameworks.
This vulnerability aligns with CWE-200: Information Exposure, as it involves the unintentional leakage of sensitive data through a side channel or improper access control mechanism. It also relates closely to CWE-862: Missing Authorization, where the application fails to enforce proper checks on user input before granting access to protected resources. In terms of MITRE ATT&CK mapping, this behavior can be associated with T1005: Data from Local System, specifically in the context of data harvesting for reconnaissance purposes. The vulnerability does not require complex exploitation techniques; it is triggered simply by viewing a page that contains content linked to restricted contact items, making it easily exploitable at scale across any Joomla! site running the affected versions.
Mitigation strategies must focus on immediate patching and defensive coding practices. Administrators should upgrade their Joomla! installations to version 5.4.8 or later for the 5.x branch, or version 6.1.3 or later for the 6.x branch, as these releases contain patches that correct the ACL verification logic within the schema.org data generation module. Until an update is applied, site administrators can implement a temporary workaround by disabling the automatic injection of contact information into structured data snippets if this feature is not strictly required for their SEO strategy. Additionally, implementing Web Application Firewall rules to monitor and block requests targeting known vulnerable endpoints may provide limited protection against automated harvesting tools. Long-term remediation should involve rigorous code reviews focusing on access control checks in all modules that output user-specific or restricted content into public-facing formats such as JSON-LD, microdata, or RSS feeds to ensure consistent enforcement of security policies across the application layer.