CVE-2026-63684

Received Received - Intake

Joomla Extension Configuration Modification via CSRF

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: Joomla! Project

Description

Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks. Unauthorized backend users or CSRF attacks could expose, create or modify extension configuration and items.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-22

Last Modified

2026-07-22

Generated

2026-07-23

AI Q&A

2026-07-23

EPSS Evaluated

N/A

NVD

CVE-2026-63684

Affected Vendors & Products

Vendor	Product	Version / Range
joomla	joomla	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability involves Joomla lacking consistent security checks for administrator actions, editor popups, and import/export requests. This means unauthorized backend users or CSRF attacks could manipulate extension configurations and items without proper validation.

Impact Analysis

An attacker could exploit this to gain unauthorized access, modify settings, or steal data by leveraging weak token, permission, and input validation checks in Joomla.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR (data protection) and HIPAA (health data privacy) by exposing sensitive information or failing integrity checks.

Mitigation Strategies

Update Joomla to the latest version immediately to ensure all token, permission, and input validation checks are applied. Review extension configurations for unauthorized changes and restrict backend user access to trusted administrators only.

Hi! I’m here to help you understand CVE-2026-63684. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70