CVE-2026-21629
Received Received - Intake
Access Control Bypass in Joomla Ajax Component for Admin Area

Publication date: 2026-04-01

Last updated on: 2026-04-09

Assigner: Joomla! Project

Description
The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-01
Last Modified
2026-04-09
Generated
2026-06-16
AI Q&A
2026-04-01
EPSS Evaluated
2026-06-15
NVD
CVE-2026-21629
EUVD
EUVD-2026-17853
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
joomla joomla! From 3.0.0 (inc) to 5.4.4 (exc)
joomla joomla! From 6.0.0 (inc) to 6.0.4 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-21629 is an access control vulnerability in the Joomla! CMS core component called com_ajax. The ajax component was excluded from the default logged-in-user access check within the administrative area, which was potentially unexpected behavior for third-party developers.

This means that certain access restrictions that normally apply to logged-in users in the admin area did not apply to the ajax component, potentially allowing unauthorized access or actions.

Impact Analysis

This vulnerability could allow unauthorized users or third-party developers to access or interact with the ajax component in the Joomla! administrative area without proper authentication.

Such unauthorized access might lead to unintended actions or exposure of administrative functions, potentially compromising the security or integrity of the Joomla! CMS installation.

Detection Guidance

This vulnerability concerns an access control issue in the Joomla! CMS core component com_ajax, where the ajax component was excluded from the default logged-in-user access check in the administrative area.

The provided resources do not include specific detection methods or commands to identify exploitation or presence of this vulnerability on a network or system.

Mitigation Strategies

The recommended immediate step to mitigate this vulnerability is to upgrade Joomla! CMS to version 5.4.4 or 6.0.4, where the issue has been fixed.

This upgrade addresses the incorrect access control vulnerability in the com_ajax component and restores the expected logged-in-user access checks in the administrative area.

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-21629. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart