CVE-2026-90916 in Joomla Extension
Summary
by MITRE • 09/29/2026
Joomla! Core - [20260906] - Core - Improper ACL checks in content history comparison view in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to view inaccessible contents.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified as CVE-20260906 represents a critical failure in the Access Control List (ACL) enforcement mechanisms within the Joomla! content management system, specifically affecting versions 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3. This flaw resides in the core functionality responsible for comparing historical revisions of articles or other content items. In a properly secured environment, the ability to view sensitive documents should be strictly governed by user permissions defined at both the global configuration level and specific asset levels. However, this implementation error allows authenticated users who lack explicit permission to access certain pieces of content to bypass these restrictions when utilizing the history comparison feature. The root cause lies in the backend logic that retrieves historical data for display; rather than re-evaluating current ACL permissions against the user's profile before rendering the comparison view, the system relies on stale or insufficiently validated state information from the initial request context. This architectural oversight creates a direct path for privilege escalation and unauthorized data exposure within the administrative interface.
From an operational perspective, this vulnerability enables attackers to perform sensitive information disclosure by viewing content that should be restricted to higher-privileged roles such as administrators or specific editors. For instance, if a website contains draft articles with confidential business strategies, legal documents, or personal identifiable information marked as inaccessible to lower-tier users like contributors or authors, an attacker exploiting this flaw can view the full text of these drafts by navigating to the history comparison endpoint for that content item. This bypasses standard frontend and backend access controls because the vulnerability exploits a blind spot in how historical records are fetched and rendered independently of real-time permission checks. The impact is particularly severe in multi-user environments where strict role-based access control is essential, as it undermines the integrity of the entire security model by allowing lower-privileged users to inspect restricted data without triggering standard error messages or denial-of-service responses that would typically alert administrators to unauthorized attempts.
This vulnerability aligns with CWE-284, which describes Improper Access Control, and more specifically reflects patterns associated with CWE-732 in some contexts where permission checks are not consistently applied across all code paths involving sensitive data access. In terms of the MITRE ATT&CK framework, this behavior is indicative of T1078 Valid Accounts combined with techniques related to unauthorized access to restricted resources, often categorized under Initial Access or Persistence depending on how the attacker leverages the gained information for further exploitation. The lack of proper validation in the history comparison view suggests a broader pattern where developers may assume that if an item was accessible during creation or initial editing, subsequent views should inherit those permissions without re-verification. This assumption fails to account for dynamic permission changes or granular restrictions applied after content publication, leading to significant security gaps.
Mitigation strategies must prioritize immediate patching of the Joomla! installation to a version where this ACL check has been corrected in the core codebase. Administrators should verify that their systems are updated beyond version 5.4.8 for the 4.x and 5.x branches or beyond 6.1.3 for the 6.x branch, as these releases contain the necessary fixes to enforce proper access validation during history comparisons. In environments where immediate patching is not feasible due to compatibility constraints with third-party extensions, temporary workarounds include restricting direct database access to sensitive tables and ensuring that web application firewalls are configured to monitor for anomalous requests targeting content history endpoints by users with low privilege levels. Additionally, auditing user permissions regularly ensures that no excessive privileges are granted unnecessarily, reducing the attack surface should similar vulnerabilities arise in other modules. Long-term remediation involves implementing rigorous code review processes focused on access control logic, particularly in features involving data retrieval and display of sensitive information, to prevent recurrence of such improper permission checks across all components of the application.