CVE-2026-90907 in CMS Extension
Summary
by MITRE • 09/29/2026
Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save controller did not check the login state of a user, allowing the creation of guest-level users on sites without active user registration.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified in Joomla installations where guest registration is explicitly disabled by the site administrator. The root cause lies in the insufficient validation of the current session state within the backend or frontend profile management module. Instead of verifying whether an active, authenticated session exists before processing account modification requests, the controller proceeds to execute database operations that result in new user entries being written to the system's user table with guest-level privileges by default when no existing credentials are provided.
From a technical perspective, this issue stems from a failure to enforce proper access control checks prior to state-changing operations. In secure web application design, any action that modifies persistent data or alters security boundaries must be gated behind robust authentication and authorization layers. Here, the profile.save endpoint fails to distinguish between requests originating from an authenticated administrator or user session versus those initiated by anonymous visitors. Consequently, attackers can craft specific HTTP POST requests targeting this controller with parameters designed to create a new username and password pair. Because the system does not validate the login state of the requester, it accepts these inputs as legitimate profile updates for non-existent users, effectively creating new accounts without requiring prior registration or administrative approval.
The operational impact of this vulnerability is significant because it provides an initial foothold within the Joomla! environment even in hardened configurations where user self-registration is turned off to prevent spam and unauthorized access. By exploiting this flaw, a remote attacker can create low-privilege guest-level accounts that may serve as stepping stones for further exploitation depending on the specific site configuration and installed extensions. While guest users typically have limited capabilities, their existence allows attackers to maintain persistent presence within the application, potentially leveraging other vulnerabilities or misconfigurations associated with user roles such as viewing restricted content if permissions are loosely defined, or interacting with features that do not strictly require high-level privileges. This undermines the integrity of the access control model and compromises the confidentiality and availability aspects of security by introducing unauthorized entities into the system.
This vulnerability aligns closely with Common Weakness Enumeration (CWE) category CWE-287, which describes Improper Authentication, as well as CWE-862, Missing Authorization, since the system fails to verify that the actor is authorized to perform account creation or modification actions. In terms of the MITRE ATT&CK framework, this behavior corresponds to techniques involving Account Manipulation and potentially Initial Access if the created accounts are used to bypass network perimeter defenses in conjunction with other exploits. The lack of session validation represents a fundamental flaw in how the application handles state management for user-related operations.
Mitigation strategies require immediate patching to the latest stable release of Joomla! where this logic has been corrected to enforce strict authentication checks before processing profile save requests. Administrators should ensure that all core components are updated and verify that no custom modifications have reintroduced similar flaws in extended modules or templates. Additionally, implementing Web Application Firewall rules can help detect anomalous POST patterns targeting user creation endpoints when guest registration is disabled, providing an additional layer of defense while patches are applied. Regular security audits focusing on access control logic across all controllers are recommended to prevent recurrence of such authentication bypass issues.