Conditions Administration Token and Permission Bypass in Joomla

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: Joomla! Project

Description

Conditions administration did not consistently enforce tokens and component/mapped-item permissions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-22

Last Modified

2026-07-22

Generated

2026-07-23

AI Q&A

2026-07-23

EPSS Evaluated

N/A

NVD

CVE-2026-63280

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability involves conditions administration not consistently enforcing tokens and component/mapped-item permissions. This means that access controls may fail to restrict unauthorized actions properly, potentially allowing users to perform actions beyond their intended permissions.

Impact Analysis

This vulnerability could allow unauthorized users to access or modify sensitive data, perform administrative actions, or escalate privileges. It may lead to data breaches, system compromise, or compliance violations depending on the affected system's use case.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating principles of data protection and privacy required by GDPR and HIPAA. Non-compliance may result in legal penalties, fines, or reputational damage.

Hi! I’m here to help you understand CVE-2026-63280. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70