CVE-2026-71573

Analyzed Analyzed - Analysis Complete

Improper CORS Origin Validation in Joomla Core

Publication date: 2026-08-18

Last updated on: 2026-09-03

Assigner: Joomla! Project

Description

Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper implementation prevented configured CORS origins from being properly validated in CORS requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-09-03

Generated

2026-09-08

AI Q&A

2026-08-18

EPSS Evaluated

2026-09-06

NVD

CVE-2026-71573

EUVD

EUVD-2026-61034

Affected Vendors & Products

Vendor	Product	Version / Range
joomla	joomla!	From 4.0.0 (inc) to 5.4.8 (exc)
joomla	joomla!	From 6.0.0 (inc) to 6.1.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-93	The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

Executive Summary

This vulnerability is an improper CORS origin validation flaw in Joomla versions 4.0.0-5.4.7 and 6.0.0-6.1.2. It allows improperly configured CORS origins to bypass validation during cross-origin requests, potentially enabling unauthorized cross-origin interactions.

Detection Guidance

To detect this vulnerability, check Joomla versions 4.0.0-5.4.7 or 6.0.0-6.1.2 for improper CORS origin validation. Review server logs for CORS requests with unvalidated origins. Use tools like curl to test CORS headers: curl -H 'Origin: http://malicious.com' -I http://your-joomla-site.com. Look for responses with Access-Control-Allow-Origin: * or unexpected origins.

Impact Analysis

This flaw could allow attackers to make unauthorized requests to the Joomla site from malicious domains. It may lead to data theft, session hijacking, or unauthorized actions on behalf of users if exploited.

Compliance Impact

This vulnerability involves improper CORS origin validation in Joomla, which could allow unauthorized cross-origin requests. This may lead to data exposure or unauthorized access to sensitive information, potentially violating compliance requirements under GDPR and HIPAA by compromising data integrity and confidentiality.

Mitigation Strategies

Update Joomla to the latest patched version (5.4.8 or later for Joomla 4.x, 6.1.3 or later for Joomla 6.x) to address the improper CORS origin validation issue.

Hi! I’m here to help you understand CVE-2026-71573. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70