CVE-2026-64793

Received Received - Intake

Content Tag Bypass in Joomla CMS

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: Joomla! Project

Description

Content tags could use ignore flags or property overrides to render restricted or unpublished articles or modules. A content author could thereby expose content to visitors who lacked the required access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-22

Last Modified

2026-07-22

Generated

2026-07-23

AI Q&A

2026-07-23

EPSS Evaluated

N/A

NVD

CVE-2026-64793

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability involves content tags using ignore flags or property overrides to display restricted or unpublished articles or modules. A content author could exploit this to show content to unauthorized visitors who should not have access.

Impact Analysis

If you are a content author or administrator, an attacker could misuse this to expose sensitive or restricted content to unauthorized users. Visitors might gain access to unpublished or private information they should not see.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements such as GDPR or HIPAA. Exposure of restricted content may result in data breaches and regulatory penalties.

Mitigation Strategies

Update Joomla to the latest version to patch the vulnerability. Review content tags and access controls to ensure restricted or unpublished articles are not exposed. Audit user permissions and module settings.

Hi! I’m here to help you understand CVE-2026-64793. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70