CVE-2026-76596 in Fabrik Extension
Summary
by MITRE • 08/22/2026
Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik < 4.7.2- The list controllers doemtpy endpoints lacks ACL gates, a plain GET empties the target list's table
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/22/2026
The vulnerability identified within Joomla extensions hosted on fabrikar.com, specifically affecting versions of Fabrik prior to release 4.7.2, represents a critical failure in access control mechanisms that allows for unauthenticated data destruction. This flaw is centered around the list controller endpoint known as doempty, which is designed to clear or truncate database tables associated with specific lists within the application. In a properly secured web application, operations that modify persistent state, such as deleting records or truncating tables, must be protected by robust authentication and authorization checks to ensure that only privileged users can perform these actions. However, in this instance, the implementation of the doempty endpoint fails to enforce any Access Control List gates before executing the database operation. This architectural oversight means that the function does not verify whether the requesting user is logged in or possesses the necessary permissions to modify data within the targeted list.
From a technical perspective, the exploitation vector for this vulnerability is notably simple and severe due to its unauthenticated nature. An attacker can trigger the table truncation by sending a standard HTTP GET request to the specific URL path associated with the doempty endpoint. Because no authentication token or session validation is required, any external actor on the internet can interact with this interface directly through their web browser or via automated scripts using tools like curl or Python requests libraries. The lack of server-side validation regarding user identity means that the application blindly trusts the request and proceeds to execute the database command to empty the table associated with the specified list ID provided in the parameters. This behavior classifies the vulnerability under CWE-284, which describes Improper Access Control, as well as CWE-613, Insufficient Session Expiration, if session-based checks were partially present but bypassed, though here it is a complete absence of authentication for a destructive action.
The operational impact of this vulnerability is catastrophic for the integrity and availability of data managed by Fabrik lists. Since the attack allows for unauthenticated table truncation, an attacker can permanently delete all records within any list that they can identify or enumerate through common enumeration techniques such as directory scanning or analyzing JavaScript files embedded in the public-facing pages of the Joomla site. This results in a complete loss of confidentiality and integrity for the affected data. Furthermore, because the action is destructive and often irreversible without backups, it constitutes a severe availability impact. In environments where Fabrik is used to manage critical business information such as customer records, inventory levels, or internal documentation, this vulnerability can lead to significant operational disruption, financial loss due to downtime, and reputational damage resulting from data loss incidents.
This type of flaw aligns with the MITRE ATT&CK framework technique T1485, specifically Data Destruction, where an adversary modifies, deletes, or corrupts data on a target system. The unauthenticated nature of this attack also reflects patterns seen in CWE-928, Improper Privilege Assignment, as the application assigns destructive privileges to users who should not have them. Additionally, it highlights issues related to CWE-601, URL Redirection to Untrusted Site, if the endpoint is accessible via simple path manipulation without proper validation of input parameters that could lead to unintended targets. The simplicity of the GET-based exploitation makes this vulnerability particularly dangerous in automated scanning environments where attackers routinely probe for common administrative or management endpoints that lack proper security controls.
To mitigate this vulnerability, immediate action must be taken by upgrading the Fabrik extension to version 4.7.2 or later, as these newer versions include patches that enforce proper access control checks on all list controller actions. For organizations unable to upgrade immediately due to compatibility constraints with other Joomla extensions, temporary mitigations should focus on network-level controls. Web Application Firewalls can be configured to block requests to the specific doempty endpoint unless they originate from trusted internal networks or contain valid authentication tokens. Additionally, administrators should review server configurations to restrict access to administrative interfaces and ensure that directory listing is disabled to prevent easy enumeration of list IDs. Regular security audits and penetration testing are recommended to identify similar misconfigurations in other parts of the Joomla ecosystem where unauthenticated destructive actions might be possible due to insufficient input validation or missing authorization checks.