CVE-2026-67284
Received Received - Intake

Improper ACL Implementation in Cotton Cloud Plugin

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: Joomla! Project

Description
Joomla Extension - tabaoca.org - Improper ACL implementation allows file operations in Cotton Cloud < 2.0.3 - Authenticated users could perform various file-related operations (read, delete, overwrite, re-assign permissions) on files owned by other users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-12
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-67284
EUVD
EUVD-2026-57162

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
joomla tabaoca to 2.0.3 (exc)
joomla cotton_cloud *
joomla gabble_chat *
joomla tabapapo_chat *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an improper Access Control List (ACL) implementation in the Cotton Cloud Joomla extension versions before 2.0.3. Authenticated users can perform unauthorized file operations such as reading, deleting, overwriting, or changing permissions on files belonging to other users.

Detection Guidance

Check Joomla extensions for Cotton Cloud versions below 2.0.3. Review file access logs for unauthorized operations by authenticated users. Inspect database entries for unexpected file permission changes or deletions.

Impact Analysis

An attacker with valid credentials could access, modify, or delete sensitive files of other users. This could lead to data leaks, data corruption, or denial of service if critical files are deleted or overwritten.

Compliance Impact

This vulnerability could violate data integrity and confidentiality requirements under GDPR and HIPAA. Unauthorized file access may lead to unauthorized data exposure, compromising compliance with privacy and security controls mandated by these regulations.

Mitigation Strategies

Update Cotton Cloud extension to version 2.0.3 or later. Review and restrict file access permissions in Joomla ACL settings. Monitor file operations and user activities for suspicious behavior.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67284. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart